General
-
Target
20221212_adobehtml.zip
-
Size
298KB
-
Sample
221212-vf3t1aef71
-
MD5
eba1bd71de819fb976549e586e62d642
-
SHA1
b771972ea4bd19141fe06624ae1c40be418ab27b
-
SHA256
94fe6a00f211ad9627153783f57b7828675e0e11979cbf16ceb26dcf966c937c
-
SHA512
f4e03521031a0ec0648e42e4802af7f9d4ed21e45b2e285beb5e55dc2140bda9ccf41463405079a75c2acfbd54a6f85cec56d62dcb39117ad336a4e8ddeb6a65
-
SSDEEP
6144:o6lsq6ywBtLBdWwzDgHaKkd2DpHYKaZrYISWtvVcQrKjYrThZtdj:NlskyddWwzMHaKG2DpHYnsfWVcnoZth
Static task
static1
Behavioral task
behavioral1
Sample
Scan_Dec12.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Scan_Dec12.lnk
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ragaxe/codXl.cmd
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ragaxe/codXl.cmd
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ragaxe/offscouring.dll
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
ragaxe/offscouring.dll
Resource
win10v2004-20220812-en
Malware Config
Extracted
icedid
814709416
ewgahskoot.com
Targets
-
-
Target
Scan_Dec12.lnk
-
Size
2KB
-
MD5
3bed3aba524f00e21b67ddf6f61eff94
-
SHA1
45bf85cb17992e2d7f572c29275a4e41a9815634
-
SHA256
432544da261f7fd918fe9db502679075b6efcb81467742c409c34b1ce1648dd6
-
SHA512
65b43ce4d63611607a69a2e9dc0ff815fc1c5a1dfd5dccf0cca463f6a33df23f309d3d91e9197688efd50d70b44fab4ca9b6183fed8ec536a9f10a8dca25cbfe
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
ragaxe/codXl.cmd
-
Size
1KB
-
MD5
b1255bfb981f5e0c8ed9701f2a50ddac
-
SHA1
7bef2c94b918fa69958c72f2570399d51f67c1bf
-
SHA256
2cd0c087dde62ece2b70fe17b113eb7495e21cd7fea0f00b64eb70d4b927f232
-
SHA512
455147d17fe301b71bd23bab485595b85cd849fde589a4ebf691d8db7a3addd5988cef1cb5e1bbeade12aef0d0ed96cdd80c121580c36aa1e22bd9954c158396
Score1/10 -
-
-
Target
ragaxe/offscouring.bin
-
Size
823KB
-
MD5
faa496bdd79e0ed4d4def753d2232bb8
-
SHA1
195dcacfb7d9a25585667e8ebdb5cd9926ffe069
-
SHA256
5c4061ed08f89eaa12f61842bc2bef83d29a2727a9dcff5d445d6b2fd120cae9
-
SHA512
0d57b824d0ac13d27e644465734cccbae50d3280dd00ab525fd4a9a965cc783e7e638960ec3f69ef31de51504f67bd4b810d0efb84808afac90d5013779bee34
-
SSDEEP
24576:4EQudEkIk9Xvw1H1F8es1F118HZsD96XXXrXXXzXXX9XXXa:4EQu2Vk9Y1H1v/HZa
Score3/10 -