icedid | cf617e8fc95d0c040fdb7d462181d21e4f988c406c9fb1545eb270030b7e3efa | Triage

Sharing

General

Target

cf617e8fc95d0c040fdb7d462181d21e4f988c406c9fb1545eb270030b7e3efa
Size

377KB
Sample

221112-nrat2afa65
MD5

1c39c87663d517ce9d08006167ed5cc3
SHA1

09fcc5bd5aed172db6e9ade461576ba2a81bf8be
SHA256

cf617e8fc95d0c040fdb7d462181d21e4f988c406c9fb1545eb270030b7e3efa
SHA512

d367aaa6f8d25941e7c7e6f9f78f20fed11c8a098e29619428a0b33998d0c5c6ee2e9bdb39d0830bb00dc8663e86c4b0a59c4b7bb128c723bb27157ce1e249b7
SSDEEP

6144:6mNegonFhyT43MVrbAMTJE2LrRohJF3bmNegonFhyT43MVrbAMTJE2LLRohJF:6uxonFgE38NpoHdbuxonFgE38NBoH

Score

10^/10

icedid 1139942657 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

1139942657

C2

newscommercde.com

spkdeutshnewsupp.com

germanysupportspk.com

nrwmarkettoys.com

Attributes

auth_var
2
url_path
/news/

Targets

- Target
  
  cf617e8fc95d0c040fdb7d462181d21e4f988c406c9fb1545eb270030b7e3efa
- Size
  
  377KB
- MD5
  
  1c39c87663d517ce9d08006167ed5cc3
- SHA1
  
  09fcc5bd5aed172db6e9ade461576ba2a81bf8be
- SHA256
  
  cf617e8fc95d0c040fdb7d462181d21e4f988c406c9fb1545eb270030b7e3efa
- SHA512
  
  d367aaa6f8d25941e7c7e6f9f78f20fed11c8a098e29619428a0b33998d0c5c6ee2e9bdb39d0830bb00dc8663e86c4b0a59c4b7bb128c723bb27157ce1e249b7
- SSDEEP
  
  6144:6mNegonFhyT43MVrbAMTJE2LrRohJF3bmNegonFhyT43MVrbAMTJE2LLRohJF:6uxonFgE38NpoHdbuxonFgE38NBoH
Score

10^/10

icedid 1139942657 banker core_loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

icedid1139942657bankercore_loadertrojan