Overview

overview

10

Static

static

documents.lnk

windows7-x64

3

documents.lnk

windows10-2004-x64

3

rap/enquire.bat

windows7-x64

1

rap/enquire.bat

windows10-2004-x64

1

rap/recons...ng.dll

windows7-x64

10

rap/recons...ng.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archive.zip

  • Size

    58KB

  • Sample

    220906-qvz97saggp

  • MD5

    258eb4e41faa8221112fe04af67e790c

  • SHA1

    02450959a308b12e6dd60d81e6c42c19221024b3

  • SHA256

    ed55687fda25549d0d8a47a2f7300db61e35a0be23d8a692ac949cbdcfe968fb

  • SHA512

    6eba74076376059de1fca932b7261fbfb0931ed68831bd8a0c78d2849c9493ff2274108185ad1224837ae5d1640f412d035ffb8aa0374fce5f95c080c9171616

  • SSDEEP

    1536:NPr30KGFJWn1dmgGWaVNy/VJllkH89hVnQNkODaxaqu2byTNG:NDhG3a1XANIplNnEg3

Score
10/10
icedid2211825656bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

2211825656

C2

academfleedalas.com

Targets

    • Target

      documents.lnk

    • Size

      1KB

    • MD5

      ad962f186df7da5e5efca61555fc47ed

    • SHA1

      9045ba63201225996bcd680cc762c56eb0a7a761

    • SHA256

      3ca66f8b12394d093fd6095c072922bf8ad718a7d0bca490eaba752766fd3b23

    • SHA512

      2144040581eeeac31788793db91a6d2d1cd145c08a7f84208c6e15d7add9d098999ac6879a56cbf4c57fcc92f128d8bb3d703b513c3898daa7b01b545f65ffb4

    Score
    3/10
    behavioral1behavioral2

    • Target

      rap/enquire.bat

    • Size

      1KB

    • MD5

      6a169bbf9da5a30adbdaa7d57f74644a

    • SHA1

      4a9f3d17e4db056004dcf6b25a543aa3fc8e10be

    • SHA256

      1a762b504316a625d6cf618804d7f2adae1278c91f4100e67294ef4d9ea81fd7

    • SHA512

      5592ceab605cb5ab39f5f1a610eca533fead47827c7403349486dd8876c9715f83e2f4e3e3151a73749f7da60e604f22119719235081b0806e6eff6d6b5009af

    Score
    1/10
    behavioral3behavioral4

    • Target

      rap/reconsolidating.dll

    • Size

      99KB

    • MD5

      eb9cbe86035927b15b31095b56b830aa

    • SHA1

      cf5acb8cbc8831ccfc373d7104636ba286f0805c

    • SHA256

      6a1ba492984c630ad274b2943b37a697c35a9147f367ddd83b42a229d7e1c27a

    • SHA512

      d7a807ecbeb671901fc0b11eb5522177f4d7d86f14da6c6bfa4ddb3a6b39c2f2e6c58e2bba125a4009d9f1f446a23a947c5f05c301a19e3291f179ab8aac2b84

    • SSDEEP

      1536:UckoJv7wXfoYNzPaRgi3WndDyKHegxaOgcSvdYP4hoGrsDKt9t5N:CAv76fhNndDyKHucSvw46GrsDyD5N

    Score
    10/10
    icedid2211825656bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks