Overview

overview

10

Static

static

3

Document.lnk

windows10-1703-x64

3

hey/superstring.dll

windows10-1703-x64

10

hey/twelfth.bat

windows10-1703-x64

1

Resubmissions

14-02-2024 18:44

240214-xdwzsaab4v 10

14-02-2024 18:41

240214-xbw7rsaa8v 3

14-02-2024 18:37

240214-w9vk6aaa4w 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    s.zip

  • Size

    109KB

  • Sample

    240214-xdwzsaab4v

  • MD5

    749d7876d8999d9b8389ef866ba926b8

  • SHA1

    7a92f5fb0c219959d234fc972e850490dcd4128d

  • SHA256

    0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba

  • SHA512

    78e28025c8f8627c39c29a40b451190001b43c936dd97aec488f3479796d3782a5654fa95781fde9eb0eed683f86c0c828108059d75ef0bd8e717e20c33e8615

  • SSDEEP

    1536:10d+vSnOjo6B6UH4HC+xCa+PWbFnggILRcl2kCpJz6Fuzp8PwMyuaPBv7Fwv2ejR:1uuSOjGUHQBbFrvWp56oCPytHwv9qq

Score
10/10
icedid612758225bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

612758225

C2

pildofraften.com

Targets

    • Target

      Document.lnk

    • Size

      1KB

    • MD5

      e1a2203f7426463cb8f2d7ebf1d72572

    • SHA1

      382f0556ada63624c6029a2c3d2d986ebf57f958

    • SHA256

      24ee1fe4baf27d375171f8749681cf1245291a52652bc3b78300f330bde71293

    • SHA512

      9b0ff9b688eaa73c525990312dbdd48951e4fd59b137725d29061a356332305e676ab1bfbd385466e42896534e0dc3af54f23d3128d96473a827d8dd1bb67c21

    Score
    3/10
    behavioral1

    • Target

      hey/superstring.dll

    • Size

      728KB

    • MD5

      293b6dc3360e7be05e35e28cc4201e47

    • SHA1

      7d2877e3eedd5b8d366b2fe44a117a9111c3d30a

    • SHA256

      645e011080488d4f5c14d217f5571372e7939c50a3568021cf9d434cf6f5f439

    • SHA512

      fb9222361b530d8a279a8e1a6342b3f71f4de9674e1f904608a86e43b6641e07a8afcfd77df0ec4c7d8f4801b408fe10be20a8cc29b3f972287ff948674c881d

    • SSDEEP

      12288:ciHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwd:cVi

    Score
    10/10
    icedid612758225bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral2

    • Target

      hey/twelfth.bat

    • Size

      1KB

    • MD5

      4e7c3ec7e4db2756209f5190355c3716

    • SHA1

      183a6caaba0208f8bdfe3bf7e25f069ecddf19f5

    • SHA256

      f2178583f6008d7ade32bb218bcd5d846859ce059875b4f603e18be57a59c7a8

    • SHA512

      d3f3ddef38d17b9b2ac209719d6bcc83d13053abc9a97e4055f1b899fbfdba054317a5c94e2a688637b18440adb120065a89a7de5ae6b84ef7b91b8922bdd768

    Score
    1/10
    behavioral3

MITRE ATT&CK Enterprise v15

Tasks