Overview

overview

10

Static

static

at/aNewWou...he.dll

windows7-x64

10

at/aNewWou...he.dll

windows10-2004-x64

10

at/forHeUs...ll.bat

windows7-x64

1

at/forHeUs...ll.bat

windows10-2004-x64

1

at/weByJus...ery.js

windows7-x64

1

at/weByJus...ery.js

windows10-2004-x64

1

invoice-no...df.lnk

windows7-x64

3

invoice-no...df.lnk

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    invoice-of-08-08-22.iso
  • Size 440KB
  • Sample220809-t2v6lschgk
  • SHA256 0a63a9f39e34606aca142d9a5ed264d6d0006002116a4bbbc813f208828245d3
  • MD5 SHA1 SHA512
Score
10/10
icedid4277954051bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 4277954051

C2

  • abegelkunic.com

Targets

    • Target
      at/aNewWouldSomeShe.txt
    • Size 240KB
    • SHA256 022472fd238d945afa6ad6846611b7e6b5efdeecdea849231457c68970995008
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid4277954051bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2
    • Target
      at/forHeUseMoreWell.bat
    • Size 44B
    • SHA256 13815ff40dbfd361a51021cc9d9427fad6c743e681ef775a392bcfcb3847991c
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      at/weByJustVeryVery.js
    • Size 201B
    • SHA256 2311a828e3fef1687b6003ed4c945daaa988abd5f7528504121d84d18e528319
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral5behavioral6
    • Target
      invoice-not-paid-date08-08-22-pdf.lnk
    • Size 1KB
    • SHA256 112ef54c2f6e23b49bdab0e15a4d9b9922775f7bf1f1cc6306db6e2cc49452bc
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks