Overview

overview

10

Static

static

icedID-06....ts.lnk

windows7-x64

3

icedID-06....ts.lnk

windows10-2004-x64

3

icedID-06....re.bat

windows7-x64

1

icedID-06....re.bat

windows10-2004-x64

1

icedID-06....ng.dll

windows7-x64

10

icedID-06....ng.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    icedID-06.09.2020.zip

  • Size

    57KB

  • Sample

    220906-slq2aacbdk

  • MD5

    4769e0a820974c7db6463f614c20705c

  • SHA1

    9c895f0a5a50ba83ac997bf2c11963efb7901053

  • SHA256

    69c4f3bc5529244ac3b9af91a98e0f15f859c61e53162aa3c7341d5973e894a6

  • SHA512

    3d80a34e473c9d2fbd1d1d95a9ee77fc607746e4f0686139c04b7e0b07bd031634cd184c4f6a76e7a082a6e6ebd4311663cadbd5afe73ec4f9704763b40bfd37

  • SSDEEP

    1536:UXm5zt8pGou6wBGailL/aToIjAohFoyB3q735:m84u6wIZat8Ka

Score
10/10
icedid2211825656bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

2211825656

C2

academfleedalas.com

Targets

    • Target

      icedID-06.09.2020/documents.lnk

    • Size

      1KB

    • MD5

      ad962f186df7da5e5efca61555fc47ed

    • SHA1

      9045ba63201225996bcd680cc762c56eb0a7a761

    • SHA256

      3ca66f8b12394d093fd6095c072922bf8ad718a7d0bca490eaba752766fd3b23

    • SHA512

      2144040581eeeac31788793db91a6d2d1cd145c08a7f84208c6e15d7add9d098999ac6879a56cbf4c57fcc92f128d8bb3d703b513c3898daa7b01b545f65ffb4

    Score
    3/10
    behavioral1behavioral2

    • Target

      icedID-06.09.2020/rap/enquire.bat

    • Size

      1KB

    • MD5

      6a169bbf9da5a30adbdaa7d57f74644a

    • SHA1

      4a9f3d17e4db056004dcf6b25a543aa3fc8e10be

    • SHA256

      1a762b504316a625d6cf618804d7f2adae1278c91f4100e67294ef4d9ea81fd7

    • SHA512

      5592ceab605cb5ab39f5f1a610eca533fead47827c7403349486dd8876c9715f83e2f4e3e3151a73749f7da60e604f22119719235081b0806e6eff6d6b5009af

    Score
    1/10
    behavioral3behavioral4

    • Target

      icedID-06.09.2020/rap/reconsolidating.dll

    • Size

      99KB

    • MD5

      eb9cbe86035927b15b31095b56b830aa

    • SHA1

      cf5acb8cbc8831ccfc373d7104636ba286f0805c

    • SHA256

      6a1ba492984c630ad274b2943b37a697c35a9147f367ddd83b42a229d7e1c27a

    • SHA512

      d7a807ecbeb671901fc0b11eb5522177f4d7d86f14da6c6bfa4ddb3a6b39c2f2e6c58e2bba125a4009d9f1f446a23a947c5f05c301a19e3291f179ab8aac2b84

    • SSDEEP

      1536:UckoJv7wXfoYNzPaRgi3WndDyKHegxaOgcSvdYP4hoGrsDKt9t5N:CAv76fhNndDyKHucSvw46GrsDyD5N

    Score
    10/10
    icedid2211825656bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks