Overview

overview

10

Static

static

Inv#08-23-...34.lnk

windows7-x64

3

Inv#08-23-...34.lnk

windows10-2004-x64

3

MANY/CASEY.cmd

windows7-x64

1

MANY/CASEY.cmd

windows10-2004-x64

1

MANY/TRACTOR.dll

windows7-x64

10

MANY/TRACTOR.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Inv#08-23-2022_052870.iso
  • Size 416KB
  • Sample220823-19b62adee5
  • SHA256 9eae7cd1f8f1ba817e3cbdfdaa4b52658c4339940c038ff3f199142de31b8915
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
icedid3093814646bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 3093814646

C2

  • dayzabazenb.com

Targets

    • Target
      Inv#08-23-2022_034.lnk
    • Size 1KB
    • SHA256 3b315b13dca1f51fcce3af906200a31c1d8c2320cd170a2d7d8442de3fb23942
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral1behavioral2
    • Target
      MANY/CASEY.cmd
    • Size 131B
    • SHA256 7faed32e50b602847bb19c776104c39dcff42394fc608d2b0ca5bf58f6238068
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      MANY/TRACTOR.DAT
    • Size 298KB
    • SHA256 3eb0d82b484a3f30c66e35eb8916d93fc9f184207859a07bb0dd55fdafa4243d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid3093814646bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks