Overview

overview

10

Static

static

3

Paid_Offer...19.pdf

windows10-1703-x64

10

Paid_Offer...19.pdf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Paid_Offer_37_Jan-19.pdf

  • Size

    166KB

  • Sample

    230120-v7wj1aba3y

  • MD5

    fdddb4f1f070bc072ef6972b86191fc4

  • SHA1

    fb014cfd210a9ce53e2aa123fe25c694bb96f08d

  • SHA256

    1b63cda2ba8f337c1499611b4abdaf43e6c16d414415093d4974518e0b627e35

  • SHA512

    af35d89cfa0f0de7e8e3f89ccaa21d216f3993c39ceeea080ecee2eb63aca65d650ce2694f98a996bbda145c84fee2a6920cc7f64fad3e678f195817d08e18de

  • SSDEEP

    3072:Uc2IpqSgb3YANiHtz8MAkU3H/ZJzss1kwSEBnok8gdLSItwv4T:UepqSGnNiHd89kE3pkMBnuPoT

Score
10/10
icedid3108046779bankerlinkloaderpdfpersistencetrojan

Malware Config

Extracted

Family

icedid

Campaign

3108046779

Extracted

Family

icedid

Campaign

3108046779

C2

klayerziluska.com

Targets

    • Target

      Paid_Offer_37_Jan-19.pdf

    • Size

      166KB

    • MD5

      fdddb4f1f070bc072ef6972b86191fc4

    • SHA1

      fb014cfd210a9ce53e2aa123fe25c694bb96f08d

    • SHA256

      1b63cda2ba8f337c1499611b4abdaf43e6c16d414415093d4974518e0b627e35

    • SHA512

      af35d89cfa0f0de7e8e3f89ccaa21d216f3993c39ceeea080ecee2eb63aca65d650ce2694f98a996bbda145c84fee2a6920cc7f64fad3e678f195817d08e18de

    • SSDEEP

      3072:Uc2IpqSgb3YANiHtz8MAkU3H/ZJzss1kwSEBnok8gdLSItwv4T:UepqSGnNiHd89kE3pkMBnuPoT

    Score
    10/10
    icedid3108046779bankertrojanloaderpersistence

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks