Resubmissions

30-11-2022 10:22

221130-mebp5abf78 10

30-11-2022 10:21

221130-md4phsed9w 10

29-11-2022 09:09

221129-k4h5dsee23 10

General

  • Target

    Iwutiwno.dll

  • Size

    200KB

  • Sample

    221130-mebp5abf78

  • MD5

    d3d203934c999b44ed06fa347a857e2d

  • SHA1

    d5939a2780dc6481ad5da612f77fc22d059b85f1

  • SHA256

    5b843acfe63caac3c1b1a85c4c80b26a93d867fd6700b2c95b12ad12ef6f386d

  • SHA512

    a47ea2e9449f607a0bc6c98af80de825c33d3f682e1a5d03778cb6f0b81652ffeeffbd7464a34159a5c1ea1fd5810b98fdfa06762bdf9cdbb8ab025fd83cf8d1

  • SSDEEP

    3072:4o+g4yy5fOYeKOc0hhtZbq2R6BBvbcByQa1UL3:btm5eK3qu2UoB6+

Malware Config

Extracted

Family

icedid

Botnet

536628885

C2

guaracheza.pics

stayersa.art

Attributes
  • auth_var

    9

  • url_path

    /news/

Targets

    • Target

      Iwutiwno.dll

    • Size

      200KB

    • MD5

      d3d203934c999b44ed06fa347a857e2d

    • SHA1

      d5939a2780dc6481ad5da612f77fc22d059b85f1

    • SHA256

      5b843acfe63caac3c1b1a85c4c80b26a93d867fd6700b2c95b12ad12ef6f386d

    • SHA512

      a47ea2e9449f607a0bc6c98af80de825c33d3f682e1a5d03778cb6f0b81652ffeeffbd7464a34159a5c1ea1fd5810b98fdfa06762bdf9cdbb8ab025fd83cf8d1

    • SSDEEP

      3072:4o+g4yy5fOYeKOc0hhtZbq2R6BBvbcByQa1UL3:btm5eK3qu2UoB6+

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

MITRE ATT&CK Matrix

Tasks