General

  • Target

    1bc191ce31861ce56280eab0ea174cba.bin

  • Size

    225KB

  • Sample

    230206-j5nwlaga9s

  • MD5

    897df8de07660b83cbe5f166f3d1d614

  • SHA1

    166c19df1b3d2c82181f39d131631f16f8cfeeff

  • SHA256

    771ca68f54ed0835f303bbffb7be7fc379e54d216a8555f53f0045fda24fa39a

  • SHA512

    30cf94291effb64686a6722d845a47fdb9228be9aaac2bb82fb4b1e96e05926c93b1d1e12ca470e8a8b15f18b2177b6057a8b1611ac6e4a8edfd68bf934b20c1

  • SSDEEP

    3072:N3VDLIIAQZ24huXOa9o0VFbwfQJ/JdV6mWycnzPXcmxnM9h5jr9VrlYicuAf3d:NlD7ATXOa9tVFbw6Y8czPI97P/riiZEN

Malware Config

Extracted

Family

icedid

Campaign

133894510

C2

restorahlith.com

Targets

    • Target

      Setup_Win_01-02-2023_19-15-32.exe

    • Size

      703MB

    • MD5

      6cbde073325643ca47db033c54220b7e

    • SHA1

      9e5c6cb72fd1d6b3e1f8b75af36c77693c244a1e

    • SHA256

      69dca2c763b58892a8a7ce5583f8ade2cd566f676727cdafe999635dcd6071eb

    • SHA512

      e5cf6608d7a80437add54192db9759057c48e1502213543d3298e3d7a109d8b4ab7796460cc8fa6df1f42529db110ef4b2f034293f57b7c09db35faa439de5f9

    • SSDEEP

      12288:o41EwgLoMgUh2W2kRSkWzgVz6iW8fPmniuwiC:XEwgL/gUEW2kRSkWzgVz6l0+iuwF

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

MITRE ATT&CK Matrix

Tasks