Static task
static1
Behavioral task
behavioral1
Sample
2024-03-27_3c54f3871a17985989d5d66554731485_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-27_3c54f3871a17985989d5d66554731485_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-27_3c54f3871a17985989d5d66554731485_icedid
-
Size
1.5MB
-
MD5
3c54f3871a17985989d5d66554731485
-
SHA1
c3b176d14255e0c8273599a7365c0db9ee523579
-
SHA256
f6a0130873529f4d25b3dd7304c63ac91a76262b84e51bdeeb74bc89e7a313c2
-
SHA512
6202e0ae5c2f41befd756ea41634ccf8f92d58fe8f273c6cf05f1d76e756d43fe31f51665a8fede438725619cd7ac7707e0637e0a54fee3dcf441c89b8645402
-
SSDEEP
24576:nnsJ39LyjbJkQFMhmC+6GD9Ijc/ghbfFZduP:nnsHyjtk2MYC5GD5/ghbfFE
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_DiscordURL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-27_3c54f3871a17985989d5d66554731485_icedid
Files
-
2024-03-27_3c54f3871a17985989d5d66554731485_icedid.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 615KB - Virtual size: 614KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 57B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 812KB - Virtual size: 811KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ