Overview

overview

10

Static

static

Scan_01-09.lnk

windows7-x64

10

Scan_01-09.lnk

windows10-2004-x64

10

copillwonv...yd.cmd

windows7-x64

1

copillwonv...yd.cmd

windows10-2004-x64

1

copillwonv...ng.dll

windows7-x64

3

copillwonv...ng.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Desktop.zip

  • Size

    333KB

  • Sample

    230109-va2dzsad3v

  • MD5

    dfd72077906b025e542231960bfbe824

  • SHA1

    13fd1546c3513260365a6066f0d97c11647fcae6

  • SHA256

    d1a4dc15a7396670b93d6a28ea2b3a54a8f19181aed1bbdb6ae1cbe28152c060

  • SHA512

    4c837e7017b327e251ac136de9953cd9d0d692b5fa2e2502c30d99b5b8e63c40a1446ef17cdea0a276bb10bcca621125086574bf515712ae6a78415ba26f1066

  • SSDEEP

    6144:DqANYmZmiA1ytlwNUc4v75NSsANtzbZCq+XmtURE14Bcqd8WG8o4M3j:mANYODRl8UcEtQTUV+1ocktT8

Score
10/10
icedid3131022508bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

3131022508

C2

wagringamuk.com

Targets

    • Target

      Scan_01-09.lnk

    • Size

      2KB

    • MD5

      c506c64591a5bad7b010c0a08bb4f25c

    • SHA1

      f65263f53c5bab142120353ef897b31cbcf31037

    • SHA256

      505553c68dd0be8cfcd9fac95234d904251ea470ec546d00398cf3440c7610bc

    • SHA512

      31ef6cee2ae78ed683cdebc8fed061b43cce1103d47fb46df5f7a7894a8d57474acbf4fb54d82d8b5eb2c0a063a029b20d9e91df1ed4fd40506ee89e510f774c

    Score
    10/10
    icedid3131022508bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      copillwonv/hipsexfryd.cmd

    • Size

      1KB

    • MD5

      cd4e29cd2e40036a15420ebc25ea24d2

    • SHA1

      b867b239b49326ac7aec9986b60620f7c256e7a4

    • SHA256

      6da903d156a109167a30e55cf323815a4418d439976232523fd3b71c04df87dc

    • SHA512

      fb88d965ce0fed7c997cb377881c51c9bc3fa9b003577e20eadd4e279991eee46985afeaf4a0a42d38261cdf371561c04e28b5ae0f204c41cf098ea6ca2bae2a

    Score
    1/10
    behavioral3behavioral4

    • Target

      copillwonv/strapping.dat

    • Size

      788KB

    • MD5

      15dd0873cb6bef0c8e89a0319a202c3a

    • SHA1

      6b49af73134d502d35d81cb978075761dc3b71fa

    • SHA256

      180bc8d0f85146d6d16fa8079e38ca5e84756f1e201fc7259464addbaee15ff2

    • SHA512

      3b1e4b176835eeae62e5ed4ac65b97e26b4471fba4aa0514c969fac8184fdcecaa82e7c9d286d9bec909bf72cce0c6cce6bfa6ec1a2adadb463a0584d6b8d200

    • SSDEEP

      12288:EtsF8uXf3ER0+FFzy9SUa5Eorp//XyZXygB:l8qUR0+FFzvea//XywgB

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks