Overview

overview

10

Static

static

HKKBAPWD.dll

windows7-x64

10

HKKBAPWD.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HKKBAPWD.XIY

  • Size

    313KB

  • Sample

    220812-vevf8shhg8

  • MD5

    1459e6b823a4a0a57e662fc37c62767e

  • SHA1

    cebf931bf69e0cd36f72091c8b2277835c0798aa

  • SHA256

    a404e5baa4888aa01ee395ba623853774cabcbc63d24c9d6559e960a47daec78

  • SHA512

    4eb61357a6f219f2487c4c60dbce8be398e69fb4e4439f8683a2bd82f2daefbaeee1fa1a21b332630111af3eb52259d7a3ecb3550a8a03aa666ddcb71565ddfc

Score
10/10
icedid3452612328bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

3452612328

C2

deficulintersun.com

Targets

    • Target

      HKKBAPWD.XIY

    • Size

      313KB

    • MD5

      1459e6b823a4a0a57e662fc37c62767e

    • SHA1

      cebf931bf69e0cd36f72091c8b2277835c0798aa

    • SHA256

      a404e5baa4888aa01ee395ba623853774cabcbc63d24c9d6559e960a47daec78

    • SHA512

      4eb61357a6f219f2487c4c60dbce8be398e69fb4e4439f8683a2bd82f2daefbaeee1fa1a21b332630111af3eb52259d7a3ecb3550a8a03aa666ddcb71565ddfc

    Score
    10/10
    icedid3452612328bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks