Extracted

• • Target

    iced/Documents.lnk

  • Size

    2KB

  • MD5

    4237deaa85e5e4bbd6b925dc5b83984a

  • SHA1

    740ae2cc9ed94d78607e3ddc7f83647434e5fade

  • SHA256

    61c2586653dfec082d45671296840368df356d2c8770c8e2d6221fb6fe29ecac

  • SHA512

    5117ce3f8ae987f32002c2313ff4d581a11d450eb597dc566204b98e17e33138da31da78d21a32f39ab0d3a213710bc35f48a9a132141468c930df0fcfee9622

  Score

  10^/10

  icedid1268412609bankerloadertrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2

• • Target

    iced/askgothogtan/forbidding.tmp

  • Size

    374KB

  • MD5

    6242b580541d24a300b10998f33af74f

  • SHA1

    091b8d919aa4d340c4872ad97488eeb7866175e6

  • SHA256

    88b2a39578b88e560fd05ec2fcd971cf63e4fbeb229026ad5c0dc3bce17ea549

  • SHA512

    c1ee8be83d598277d7db31e9aad0318e710e73c5a89a61fc7554e79470ff8fab637954038a4817e5da188be20741bab2c6302c1c1df97df90c5c5b36d4913d13

  • SSDEEP

    6144:00FOhm3Y1LfpDqnkIBwcu/oDdzr88vAHL/l7ysDPXoPcTPinEgrTytlRNKIg8ggd:00km3YYY/ohhvAHLoWPXoPcTPbgrmtlR

  Score

  3^/10
  behavioral3behavioral4

• • Target

    iced/askgothogtan/ginbum.cmd

  • Size

    1KB

  • MD5

    9c5c165f68040c27ca493218e54a57ef

  • SHA1

    e18932c39422969e5908dce3260acae4e46a11ad

  • SHA256

    791ece5a1f7a84eb20786454ec917d3ef16a0a57a7d5e9ecbeb069151cdd16d4

  • SHA512

    fed35aa7628d645d20028d4c106b3899ea459480645a33c720d645dc339637e92033260a0187b33f421b74a5b1df97845bd2d6af833dc4fbfcf4c275937fc638

  Score

  1^/10
  behavioral5behavioral6