General

  • Target

    6865ca56665542cd7d5c1c53a76f32ca.bin

  • Size

    1.8MB

  • MD5

    8387fefd3f301af8fa750628aa253276

  • SHA1

    3d6671a23d39133810386a8968a1553d3145af4f

  • SHA256

    2154488682e7fa52945812b2e217fb68bba0bb1baafe02de905e6616f2b65c2f

  • SHA512

    bd7178b65e3e03ea4071e68b25120f899a809cb41ca11a683aab63303c20fc9b359483a612a786bd1a4c53c22df42e5b60b22116b6f765604b03d92d16c52049

  • SSDEEP

    49152:Ekd7b3J2BjqGyNS69bmS3hm4JLUdHUsvlAdV2:EkyyS69ZUldHgV2

Malware Config

Extracted

Family

icedid

Signatures

  • Detected TEARDROP fileless dropper 1 IoCs

    TEARDROP is a memory-only dropper which can read files/registry keys, decode an embedded payload, and load it directly into memory.

  • Icedid family
  • Matiex Main payload 1 IoCs
  • Matiex family
  • Teardrop family
  • Detectes Phoenix Miner Payload 1 IoCs

Files

  • 6865ca56665542cd7d5c1c53a76f32ca.bin
    .zip

    Password: infected

  • 6fa0ea46cdf13cc71d9a164d0291f481d3947ec4f35f2cbf7b5c4a51ae3b0aed.exe
    .exe .js windows x86