Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

demoscan-1...ng.lnk

windows7-x64

10

demoscan-1...ng.lnk

windows10-2004-x64

7

lxLoqZul.dll

windows7-x64

10

lxLoqZul.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    demoscan-130722.31825.iso

  • Size

    1.7MB

  • Sample

    220919-t6jy5scgar

  • MD5

    88ca10f6e39c035a2e7aab18df39b139

  • SHA1

    a4b5a5b3bb7baa34b661acc163c2aa38bb17ad68

  • SHA256

    81036c210b754106c62d396300d1fd11c1ec9f6e555b8ab216fb207b9a51a398

  • SHA512

    a1cb0e2396a43cbd7867d223acf71f0e2e42ef565c357444d4954bd33af243f191807868575f4cbe33a15aa0e45304c28fc7dc51c7b73d859f0f416f1f5d1a54

  • SSDEEP

    24576:Avqdzj0ZWsZ91emqtQvNA/8Jtiu4Wb144dy60GyeAyYLM:AvXX1ePsvB3bd0GyeAyYL

Score
10/10
icedid775636601bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

775636601

C2

aviadronazhed.com

Targets

    • Target

      demoscan-130722.31825.png.lnk

    • Size

      1KB

    • MD5

      94becc82bec4b426037f84299cf26513

    • SHA1

      c10372b5620ca781e45223beb28523a6ab393d3a

    • SHA256

      8f3a28d2fb7c2ec67f083194a9c44edef94c20c1d5b10e2d0e45385c5f7b542f

    • SHA512

      f7e86bb9ccfdf0651ba13738226ba222a74acec35a578aa7a297a54ab23aaccc3d241259fb495c3aca50b076fb12c017e314761b220f0ce4e0dd466fe72472d8

    Score
    10/10
    icedid775636601bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      lxLoqZul.dll

    • Size

      452KB

    • MD5

      93e4b4fd7a07227f07a610790b8e250b

    • SHA1

      ecbe925735cbfa4685ed265bb92177fc821b7b2f

    • SHA256

      056d807ab2d077efaf148ca7c2f350710a92c795ec100c0c28fc95d2bb566d8d

    • SHA512

      10de87b22b851d0ef741ea290fdd640c98b8fea9f30c6294cf1051a8e30b887edfd5894de4a77fd842692567ca8ef7fb4c8ec7c5c3ef5e01035c75d2d8c513cd

    • SSDEEP

      6144:FcwOnhu0n/yvHtFxTv80J0TET7FWQ+ItFMu5P1rh/I9I1ezFxsbxBFtfCnYL6354:FkyfS0Gn21epxsvqYL85om8

    Score
    10/10
    icedid775636601bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks