Extracted

• • Target

    f2d5895a8e66ef63e687e356dac665cf.msi

  • Size

    772KB

  • MD5

    f2d5895a8e66ef63e687e356dac665cf

  • SHA1

    d5ec3af492980df0bcbca26ceb864177978ef69d

  • SHA256

    6b4239bdb1080b21570feba7058d87b35e18bc74c20c68611c2012002b8a0aa3

  • SHA512

    d1ff00a258a811f395e91dcca6a22e8dd839aef606f74d2ef78391e01d4ce13d490903b6d9378c114ba0f880cb698d76027e62e3832ea1a97fe4ba8cfb4bb1a8

  • SSDEEP

    12288:GwHL0DpPMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:vHL02vwglMtNjjoGS3bRPF8L

  Score

  10^/10

  icedid2957048208bankerloadertrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2