Overview

overview

10

Static

static

3

Document.lnk

windows7-x64

4

hey/superstring.dll

windows7-x64

10

hey/twelfth.bat

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    s.zip.zip

  • Size

    109KB

  • Sample

    240309-zsh3ksab76

  • MD5

    f38428e8ba0c4d1c0c7a5d0cfa78c25c

  • SHA1

    3ad008936d12e4aab3cb8481ed6898d98f03ab97

  • SHA256

    fed94556d81622a39c4bfbaf39fa11dcab6a9b63fc487e037ccb1771f92ea894

  • SHA512

    b43a91ff8680bea849987a6969da41155f4ea3efc8d57d7592135a2c48b874203e8a21053d4607487e6a523d72926c5bca8c569951a3308802b3a743a4dd48d6

  • SSDEEP

    3072:7X21vskWriCiMb8UA0gRP8DuRCWxfGxOskz5PQokcQV0T:7X2Bsk28Y8UA08OuTxexOgL2T

Score
10/10
icedid612758225bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

612758225

C2

pildofraften.com

Targets

    • Target

      Document.lnk

    • Size

      1KB

    • MD5

      e1a2203f7426463cb8f2d7ebf1d72572

    • SHA1

      382f0556ada63624c6029a2c3d2d986ebf57f958

    • SHA256

      24ee1fe4baf27d375171f8749681cf1245291a52652bc3b78300f330bde71293

    • SHA512

      9b0ff9b688eaa73c525990312dbdd48951e4fd59b137725d29061a356332305e676ab1bfbd385466e42896534e0dc3af54f23d3128d96473a827d8dd1bb67c21

    Score
    4/10
    behavioral1

    • Target

      hey/superstring.dll

    • Size

      728KB

    • MD5

      293b6dc3360e7be05e35e28cc4201e47

    • SHA1

      7d2877e3eedd5b8d366b2fe44a117a9111c3d30a

    • SHA256

      645e011080488d4f5c14d217f5571372e7939c50a3568021cf9d434cf6f5f439

    • SHA512

      fb9222361b530d8a279a8e1a6342b3f71f4de9674e1f904608a86e43b6641e07a8afcfd77df0ec4c7d8f4801b408fe10be20a8cc29b3f972287ff948674c881d

    • SSDEEP

      12288:ciHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwd:cVi

    Score
    10/10
    icedid612758225bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral2

    • Target

      hey/twelfth.bat

    • Size

      1KB

    • MD5

      4e7c3ec7e4db2756209f5190355c3716

    • SHA1

      183a6caaba0208f8bdfe3bf7e25f069ecddf19f5

    • SHA256

      f2178583f6008d7ade32bb218bcd5d846859ce059875b4f603e18be57a59c7a8

    • SHA512

      d3f3ddef38d17b9b2ac209719d6bcc83d13053abc9a97e4055f1b899fbfdba054317a5c94e2a688637b18440adb120065a89a7de5ae6b84ef7b91b8922bdd768

    Score
    1/10
    behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks