Overview

overview

10

Static

static

b2bfbf4ebe...f.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2bfbf4ebee23a12425d38e65482a578add6109f9feb1a3fad92a8e00a465aef.html

  • Size

    1.6MB

  • Sample

    221012-s9waxaaag8

  • MD5

    5a81bb374e81533579ebbe839ee47fea

  • SHA1

    14c31aed809fb360e2f1e0d328414fbc87441b39

  • SHA256

    b2bfbf4ebee23a12425d38e65482a578add6109f9feb1a3fad92a8e00a465aef

  • SHA512

    a940c715a220bebb068eb45e73ff98b8bf1e25daa16ffe559dfd372389a553c4d253d71eda91798db08cba063257dbd665a274f7d36a49a5263979c71d80e380

  • SSDEEP

    24576:Um49ebBHSjIYBOZUPmT+haWSQ4HYHLQ2NOgZMEe2N0W6SQoCll0n:UdjIhZGmUae44HLQzsmjSDrn

Score
10/10
icedid140125615bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

140125615

C2

fireskupigar.com

Targets

    • Target

      b2bfbf4ebee23a12425d38e65482a578add6109f9feb1a3fad92a8e00a465aef.html

    • Size

      1.6MB

    • MD5

      5a81bb374e81533579ebbe839ee47fea

    • SHA1

      14c31aed809fb360e2f1e0d328414fbc87441b39

    • SHA256

      b2bfbf4ebee23a12425d38e65482a578add6109f9feb1a3fad92a8e00a465aef

    • SHA512

      a940c715a220bebb068eb45e73ff98b8bf1e25daa16ffe559dfd372389a553c4d253d71eda91798db08cba063257dbd665a274f7d36a49a5263979c71d80e380

    • SSDEEP

      24576:Um49ebBHSjIYBOZUPmT+haWSQ4HYHLQ2NOgZMEe2N0W6SQoCll0n:UdjIhZGmUae44HLQzsmjSDrn

    Score
    10/10
    icedid140125615bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks