Extracted

• • Target

    Setup_Win_31-12-2022_01-50-16.msi

  • Size

    772KB

  • MD5

    4509edb7effdfc57e288bb7b23fa0180

  • SHA1

    edd9910a9b2774e5a9a36ca096d299b092556016

  • SHA256

    c0a063352598eae28f226207503d864a06f5490497b074a9390927793ea16bfd

  • SHA512

    c6a321a42f6235e89b9c256ccdc2d697437baa07574c4da12e65a8c225a007f5da7a6e9b8e14d88a27de19d7b78b5375e3938c5be9054fa62f645fe2420afda0

  • SSDEEP

    12288:TwHL0DpsMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:0HL0tvwglMtNjjoGS3bRPF8L

  Score

  10^/10

  icedid2957048208bankerloadertrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2