Overview

overview

10

Static

static

Document.lnk

windows7-x64

3

Document.lnk

windows10-2004-x64

3

belts/anyhow.dll

windows7-x64

10

belts/anyhow.dll

windows10-2004-x64

10

belts/coleman.cmd

windows7-x64

1

belts/coleman.cmd

windows10-2004-x64

1

belts/sinus.cmd

windows7-x64

1

belts/sinus.cmd

windows10-2004-x64

1

Resubmissions

11-11-2022 10:35

221111-mm1n8ahd3z 10

11-11-2022 05:40

221111-gcv34ahed6 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document_OF62.iso

  • Size

    428KB

  • Sample

    221111-gcv34ahed6

  • MD5

    88c823ff377b101e6f948f3f34b467c5

  • SHA1

    ece067f744b35128b1ab6e0ddc142263ede1c3bd

  • SHA256

    e6a2e75a6b2a3f2ac324ed063728d53dd0ff40e24e2abe11a725c41a54aabfe9

  • SHA512

    ac31a111d171fb938665d84d76c026794efce66f45af8c738fc18cd569552a6d8f6b236cd71e6df3544ce45abceceeaef5147561f8c1e5f6107df3349cab11c3

  • SSDEEP

    6144:dd1Im48xJjSbUhI77ETb+JS+lDDWbOrL/ZslDP/w+lDxlDuSTjQBRlDFKLEzbrbU:r1ImVJj0Rfyg7QKbuGiKpw9

Score
10/10
icedid426369791bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

426369791

C2

ahilacarstrupert.com

Targets

    • Target

      Document.lnk

    • Size

      1KB

    • MD5

      5285072bd147d8b3c46337442c45d6f6

    • SHA1

      aa69b57e188a84f02dff41b3bb9f5d3185d6d21d

    • SHA256

      2709e19c5241ec78b7852bcd78498884a2a1147e0273a194fd235f62cdc786cc

    • SHA512

      2cc1ec6077e937ad2f35f397c6ca72add62ed5d1f2ae5dd77520c87179ec879239fe8fd5f9fddd2ae73fb1b964afc3e442f9173f6df94ff541cf2bb763aa6899

    Score
    3/10
    behavioral1behavioral2

    • Target

      belts/anyhow.tmp

    • Size

      91KB

    • MD5

      13563c9b38c5aa0e0efbd7b3fbbbb32d

    • SHA1

      fb6d2a7852d1b447a0fc2d1fd18108d81639ef91

    • SHA256

      64598e2bc1c0f58636825193c93405d555a5fcd87816ec22842125629d3136ad

    • SHA512

      a07559208fa4dd280ca53133d08fcd82430c36d19a890cdf2eedfdedb3e98235c10c5dfb0967354929da684f6e51dff712f4da819af71dd81453a6ed32c9f3f2

    • SSDEEP

      1536:vXREXIBJWIsBMwYrUvjwI7CdiZEkgusxGEgG+JWx+1GlR:ZicWIsBiUcI7CWrgus49KxJlR

    Score
    10/10
    icedid426369791bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral3behavioral4

    • Target

      belts/coleman.cmd

    • Size

      182B

    • MD5

      079f76e0ebf45dd46b4c5a7cf6eac2dd

    • SHA1

      91a054be6fedf3d592315e7e0d9e0ac91bf3938d

    • SHA256

      f0357b0a99f1dd3a389c18768f38863f949cb8d79cf71d0273ee9875ce88ab7e

    • SHA512

      5a7a41e9a89ca526c00d6e2008c1d5917ab13ab90454a8eef84b2ffcda96f2da1e59de480e8a3ad361a78008bc87c47c1c807e954e05e3ab5b6873407886c4de

    Score
    1/10
    behavioral5behavioral6

    • Target

      belts/sinus.cmd

    • Size

      275B

    • MD5

      fd0220a4dd09b7ae925c622720d1d834

    • SHA1

      380797b2395ac2e4ed98466fb7bd4f0d753097ef

    • SHA256

      0e56587cbdddd1851d2db510d6a539bc325029bc55e66a9d2cd9f011125b12b8

    • SHA512

      d921ca10a3b4ac477580b08921332a22cd626f7cb1130160fec5fec6258fc51d23f0eb49d9a88dbc2865a5116dfb1fe30f162d09ec18e73ef2ccca6ecf25a701

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks