icexloader

General

Target

0a4a16611f30009f7872929eb92cd9599aa16fabd4ae0b829f6aa019eca207eb
Size

288KB
Sample

220911-xwb3bscag6
MD5

8f558e6207134f1e705bef422d327a9e
SHA1

b80d29dd3e273314ac1a0b3ad860090939044501
SHA256

0a4a16611f30009f7872929eb92cd9599aa16fabd4ae0b829f6aa019eca207eb
SHA512

f76c70880ae264e75561a1a235304917dc5fd6f992a0a91f214aa34fb036124e5f14e8003b11973de24d2fdd82f436591f725077d55b1fa7be33d52b1f26c285
SSDEEP

6144:BqWlUU99VqbCeJ9U6cU2idtkg4noSerEWLSE4LOxENCS:BvU06uS+6cU2idtkg4lerEWaLJF

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate

Extracted

Family

raccoon

Botnet

567d5bff28c2a18132d2f88511f07435

C2

http://116.203.167.5/

http://195.201.248.58/

rc4.plain

Extracted

Family

icexloader

C2

http://microsoftdownload.ddns.net:8808/Server/Script.php

Targets

- Target
  
  0a4a16611f30009f7872929eb92cd9599aa16fabd4ae0b829f6aa019eca207eb
- Size
  
  288KB
- MD5
  
  8f558e6207134f1e705bef422d327a9e
- SHA1
  
  b80d29dd3e273314ac1a0b3ad860090939044501
- SHA256
  
  0a4a16611f30009f7872929eb92cd9599aa16fabd4ae0b829f6aa019eca207eb
- SHA512
  
  f76c70880ae264e75561a1a235304917dc5fd6f992a0a91f214aa34fb036124e5f14e8003b11973de24d2fdd82f436591f725077d55b1fa7be33d52b1f26c285
- SSDEEP
  
  6144:BqWlUU99VqbCeJ9U6cU2idtkg4noSerEWLSE4LOxENCS:BvU06uS+6cU2idtkg4lerEWaLJF
Score

10^/10

icexloader netsupport raccoon 567d5bff28c2a18132d2f88511f07435 collection discovery loader persistence rat spyware stealer
- Detects IceXLoader v3.0
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- icexloader
  IceXLoader is a downloader used to deliver other malware families.
  loader icexloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1