Overview

overview

10

Static

static

Document.lnk

windows7-x64

3

Document.lnk

windows10-2004-x64

3

belts/anyhow.dll

windows7-x64

10

belts/anyhow.dll

windows10-2004-x64

10

belts/coleman.cmd

windows7-x64

1

belts/coleman.cmd

windows10-2004-x64

1

belts/sinus.cmd

windows7-x64

1

belts/sinus.cmd

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    966a9673-0b3f-4f2e-9902-e60195afd4b9.zip

  • Size

    108KB

  • Sample

    221111-gcv34abdhp

  • MD5

    820f500a9f7503e8b6c3cef29412b00a

  • SHA1

    aef336e5bb36e84f9770399925062c546df3ece7

  • SHA256

    02ca1b0e4025a81f5fdb000591750d72e28551dba49aa26ea5f39d68d6597777

  • SHA512

    b225e7c4decc4b8c41f328c9794dd10b29ae51a5309a7775e4e62beca6b176fc58d852ce1aebc73212725c450eee2d14ac9f5061b8a96cbcb14aa151ab2c46bb

  • SSDEEP

    3072:PZQzkqvWwI/RJEBvnllY7ydW5ZOdvcvZrUH16:PZGo/RJSvlKy8YRcvZIV6

Score
10/10
icedid426369791bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

426369791

C2

ahilacarstrupert.com

Targets

    • Target

      Document.lnk

    • Size

      1KB

    • MD5

      5285072bd147d8b3c46337442c45d6f6

    • SHA1

      aa69b57e188a84f02dff41b3bb9f5d3185d6d21d

    • SHA256

      2709e19c5241ec78b7852bcd78498884a2a1147e0273a194fd235f62cdc786cc

    • SHA512

      2cc1ec6077e937ad2f35f397c6ca72add62ed5d1f2ae5dd77520c87179ec879239fe8fd5f9fddd2ae73fb1b964afc3e442f9173f6df94ff541cf2bb763aa6899

    Score
    3/10
    behavioral1behavioral2

    • Target

      belts/anyhow.tmp

    • Size

      91KB

    • MD5

      13563c9b38c5aa0e0efbd7b3fbbbb32d

    • SHA1

      fb6d2a7852d1b447a0fc2d1fd18108d81639ef91

    • SHA256

      64598e2bc1c0f58636825193c93405d555a5fcd87816ec22842125629d3136ad

    • SHA512

      a07559208fa4dd280ca53133d08fcd82430c36d19a890cdf2eedfdedb3e98235c10c5dfb0967354929da684f6e51dff712f4da819af71dd81453a6ed32c9f3f2

    • SSDEEP

      1536:vXREXIBJWIsBMwYrUvjwI7CdiZEkgusxGEgG+JWx+1GlR:ZicWIsBiUcI7CWrgus49KxJlR

    Score
    10/10
    icedid426369791bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral3behavioral4

    • Target

      belts/coleman.cmd

    • Size

      182B

    • MD5

      079f76e0ebf45dd46b4c5a7cf6eac2dd

    • SHA1

      91a054be6fedf3d592315e7e0d9e0ac91bf3938d

    • SHA256

      f0357b0a99f1dd3a389c18768f38863f949cb8d79cf71d0273ee9875ce88ab7e

    • SHA512

      5a7a41e9a89ca526c00d6e2008c1d5917ab13ab90454a8eef84b2ffcda96f2da1e59de480e8a3ad361a78008bc87c47c1c807e954e05e3ab5b6873407886c4de

    Score
    1/10
    behavioral5behavioral6

    • Target

      belts/sinus.cmd

    • Size

      275B

    • MD5

      fd0220a4dd09b7ae925c622720d1d834

    • SHA1

      380797b2395ac2e4ed98466fb7bd4f0d753097ef

    • SHA256

      0e56587cbdddd1851d2db510d6a539bc325029bc55e66a9d2cd9f011125b12b8

    • SHA512

      d921ca10a3b4ac477580b08921332a22cd626f7cb1130160fec5fec6258fc51d23f0eb49d9a88dbc2865a5116dfb1fe30f162d09ec18e73ef2ccca6ecf25a701

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks