Extracted

• • Target

    ZoomInstallerFull.exe

  • Size

    75.4MB

  • MD5

    3d36e5c4caa98515b4cbede14c253676

  • SHA1

    d2e1bd8ee0a2185557e5c01883cdccb53772f7bb

  • SHA256

    c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a

  • SHA512

    b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182

  • SSDEEP

    1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ

  Score

  10^/10

  icedid1441853872bankerloaderpersistencetrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3