C:\Users\ihate\Desktop\RegulusAIO\RegulusAIO\obj\Release\RegulusAIO.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-27_86f59b9c2fe05f07425427f07c95261c_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-27_86f59b9c2fe05f07425427f07c95261c_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-27_86f59b9c2fe05f07425427f07c95261c_icedid
-
Size
1.5MB
-
MD5
86f59b9c2fe05f07425427f07c95261c
-
SHA1
1e9edd1d499c0edc932c82ac9792a7ef58364ee0
-
SHA256
2b48ab3cf29c08c8fbc459c0e67fb0bf6bb38cf31d759ea99f830e1028e9a28a
-
SHA512
663cbf523b82c5f2bf1434bcdb822af119f7ef8197979b47f736bc8bc5b167eab88eb1740d853a53ee0a7202b2a12b534efefefdb39396075f1a01bb67b3be07
-
SSDEEP
24576:+Tm4OrOY6wMdgSYAaaJVFAGecyTlYgSV5Tnsveu:R4izxMdgNA5VFA8hgSV5zs
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_DiscordURL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-27_86f59b9c2fe05f07425427f07c95261c_icedid
Files
-
2024-03-27_86f59b9c2fe05f07425427f07c95261c_icedid.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ