Overview

overview

10

Static

static

8

challenge-...top.gz

windows7-x64

3

challenge-...top.gz

windows10-2004-x64

3

Stairs.txt

windows7-x64

1

Stairs.txt

windows10-2004-x64

1

challenge-...sk.txt

windows7-x64

1

challenge-...sk.txt

windows10-2004-x64

1

challenge-...64.dll

windows7-x64

10

challenge-...64.dll

windows10-2004-x64

10

challenge-...st.hta

windows7-x64

1

challenge-...st.hta

windows10-2004-x64

1

challenge-...st.dll

windows7-x64

10

challenge-...st.dll

windows10-2004-x64

10

challenge-...1.docm

windows7-x64

10

challenge-...1.docm

windows10-2004-x64

10

challenge-...c.pcap

windows7-x64

3

challenge-...c.pcap

windows10-2004-x64

3

challenge-...se.dat

windows7-x64

3

challenge-...se.dat

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    challenge-files.zip

  • Size

    4.8MB

  • Sample

    221019-w17jcscabl

  • MD5

    4edf33b3a4dd1c1c005aefeaa29c7f1d

  • SHA1

    e4d4bb8c8dcf357b068019660fdc72e65f577857

  • SHA256

    d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

  • SHA512

    b647d071e71ece4a4d5d4601f28cbcab9f12a85014f1d06cc80ed65f35c7d3f81fc0b27cfd0855b456194f50e7f5dd2ce9588077735c2ec7f43f4a1e38ee2803

  • SSDEEP

    98304:DfFixex8es3YZIbSNMDHMDhODrxaQe8vNzLB/RensEGdCW/1BTK4EBzaQyLzZ:sAx8eOHawsDhk0QlvNLB/0nsEGdCWNIu

Score
10/10
icedid987543880548569227bankercore_loaderloadermacrotrojan

Malware Config

Extracted

Family

icedid

Botnet

987543880

C2

fimlubindu.top

vindurualeg.top

bigcostarikas.top

extrimefigim.top
Attributes
  • auth_var

    6

  • url_path

    /news/

Extracted

Family

icedid

Campaign

548569227

C2

supplementik.top

Targets

    • Target

      challenge-files/challenge-files/2021-06-02-fake-gzip-file-from-supplementik.top.bin

    • Size

      730KB

    • MD5

      0208817d1a0a9bd2b5ba9bb87eb934d6

    • SHA1

      ba190c8cfba453e163dc0035ece7d3a1c0c4e08f

    • SHA256

      ea872a29ed2189432ff3f8ce807412eaa200928fadf9eb918518be5d5bd0ca1e

    • SHA512

      2a4c26bee05c2d1f0e5629fa692d3bd41540e04dbc690604c050f72a03cab9bafff7dd4a7ae8587b59fed77211c1c1f278b6a3b860a0ec6c1846199a971174b5

    • SSDEEP

      12288:yKKYkbSL7/TaiQmAyBkK2hA2nczTsoQ+g7GuFg5+GAoWv6RbrjUyHzvyTA:xK7SL6LmAyBk1A2nqBsGT5W6RbrjJzKA

    Score
    3/10
    behavioral1behavioral2

    • Target

      Stairs.txt

    • Size

      4B

    • MD5

      fb248367e3f32e447a4e6da1c6975a70

    • SHA1

      6bf43c5b1e0303f5d3b03a339c367cbabafa1310

    • SHA256

      a985289db7d6043514f3769eb6276cb294bb795dec2fbf0090d9c07595bd7df7

    • SHA512

      bf09abaa0f21f786263f407f77fad5a82de0993aad0a0c9a2984d549d4b83b64a896b8c829407597b7ca64145f6be40fdf2dfb328c38ba76f15c926955066205

    Score
    1/10
    behavioral3behavioral4

    • Target

      challenge-files/challenge-files/2021-06-02-scheduled-task.txt

    • Size

      3KB

    • MD5

      ff47adff77ee92cb02730d97dcce8a74

    • SHA1

      197285a59cc33d98cf4b825bcee924a24812f118

    • SHA256

      1f9df4bb10d7b39c1349f9796c59357fa618e5629ab84b18ca37cb2d21fc7f07

    • SHA512

      675e171920bfb4088a4ef078bc79bf444e5b6abc57ae96e03b57cf5ca92e3cdd1df3522ffd15461f99ceb9672160ef19990ff9d814d8ea8e498dab74df69355d

    Score
    1/10
    behavioral5behavioral6

    • Target

      challenge-files/challenge-files/Tetoomdu64.dll

    • Size

      396KB

    • MD5

      6ed61b28923f1894663174a13a9a789f

    • SHA1

      787447b91095e8bb4f696a69c4b7cbaaf302e8c1

    • SHA256

      3ed5d0476d1ce4fd325666072983d295609fe94c5b65d5db47a53f462ac7a4dc

    • SHA512

      5d800fcb3ba63087d55992d9becd5db3a74ad18f75a84f2cae12faae50eb895f0482a6b3b069ddbc31033ee4f88279e4e33339a9058dac9425b628f1015c5ac7

    • SSDEEP

      6144:xe+1VoOnuR9/G8z+TxcIPpypXSmn4UohdE1xH+f:xROMu68giIP0imXonE3

    Score
    10/10
    icedid987543880bankercore_loadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral7behavioral8

    • Target

      challenge-files/challenge-files/collectionBoxConst.hta

    • Size

      3KB

    • MD5

      99a1a4391c6be3ac5f137c0a092d8edd

    • SHA1

      34afc663a569d0ba183c73ab40ae8d682273d193

    • SHA256

      b25865183c5cd2c5e550aca8476e592b62ed3e37e6b628f955bbed454fdbb100

    • SHA512

      45e5b38d72add4d28234b539071a3cb4059c9c104b5389a43190fd3197843e103fdaf7552c1edcb9bbbabe15b122a8bef0389ce39d6130b438a835c4c2d4f345

    Score
    1/10
    behavioral9behavioral10

    • Target

      challenge-files/challenge-files/collectionBoxConst.jpg

    • Size

      538KB

    • MD5

      65641f6498b6f94b0bdeb886e448d460

    • SHA1

      b17591ec88cccf664f911f6e8a235e082e6bd892

    • SHA256

      51658887e46c88ed6d5861861a55c989d256a7962fb848fe833096ed6b049441

    • SHA512

      3896899d6c80de9dd383d15dde246a4478e94b72b7c780da9a3b4e2068aac85929b8665fbe8055ca9d1586c93fc1a7cc4dbdacf47cb3b3079d1830853ba9041c

    • SSDEEP

      6144:8DLTDShETtXZAngMPZQn41hGEn1qaM8nOD4E8ONTxyohggJXZrO:8PTDS6TvfImgBe8nO4oZG

    Score
    10/10
    icedid548569227bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral11behavioral12

    • Target

      challenge-files/challenge-files/docs 06.02.2021.doc

    • Size

      43KB

    • MD5

      f08771b9fdfe82caaa089641e2348c8e

    • SHA1

      b02c121597c9d56d7fab76b54834d5f3bd961e8c

    • SHA256

      cc721111b5924cfeb91440ecaccc60ecc30d10fffbdab262f7c0a17027f527d1

    • SHA512

      3bb2b582e7119c346473f78056f95e0890a3e74976de733739af9aaef810c4e62b35d7f81ec52acfbf675d3d501a048a36fa323ef76ee8843502424211b46ebd

    • SSDEEP

      768:u5WkgUEeFPIlj5oQ0fUDjxXSwU/+BtgKpyAAlQg6DPLFXS:plekVoQTCFmgKpslepC

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral13behavioral14

    • Target

      challenge-files/challenge-files/infection-traffic.pcap

    • Size

      3.9MB

    • MD5

      c7fcd889649eb0229620b2cc0fba5add

    • SHA1

      ab507bd070f99a3bce726176b37b1fb7d907d97c

    • SHA256

      14c26cf8ded22562b9d0f5d2923f20e27515dbedc25c97976889927d598ee262

    • SHA512

      a3ad9b15de43141d0fcf2cacceccdb70ed4b430330c769d630ccdf4780a936222c20a1ac6a94a6610a26b13a9d5421222ef2a9f751332146db569c72ab646016

    • SSDEEP

      49152:FHLP2dei6dBNQvmmnUOTJA/avOYTsGKHTDy8Fr6HHTWVdiiUoornjvO59P1lgREH:oI5alUEa/wOIsG0e8IHHpooVREJS7

    Score
    3/10
    behavioral15behavioral16

    • Target

      challenge-files/challenge-files/license.dat

    • Size

      333KB

    • MD5

      3c6263a9c4117c78d26fc4380af014f2

    • SHA1

      eca410dd57af16227220e08067c1895c258eb92b

    • SHA256

      29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

    • SHA512

      0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

    • SSDEEP

      6144:zsBoiLlIorxTbp4o8x4It25elAQpB/lP3O21uZoXq8ZTipooUDFkPt8gi976D+se:YKIIMxTbp4otQAQpdl221U89ipTc4CRd

    Score
    3/10
    behavioral17behavioral18

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

6
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks