2024-03-27_5030ac319586ca9278a06e8421c89f1b_icedid

General

Target

2024-03-27_5030ac319586ca9278a06e8421c89f1b_icedid
Size

1.9MB
MD5

5030ac319586ca9278a06e8421c89f1b
SHA1

369583bd84876bf6cc7adcedd44aefd62b8b1b3d
SHA256

2083f5577c85fab6e51002ff36b5d1b2f27b7e3bce3dc1b92b9809561209e745
SHA512

d4f858d6d59c2e6aa195698e24723c379ba09bce1040fe53d710ab2fdd831d4b727daba59524dcfffd7e98b724130acf13d295c78b12afed7c8dba0a96cae68d
SSDEEP

49152:8nsHyjtk2MYC5GDVTq24GjdGS9hWb2J3Y2pwOIYiUYrp+nMum:8nsmtk2aNEjdGSGb2Jo2GOIYiUYrpCMx

Score

10^/10

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-27_5030ac319586ca9278a06e8421c89f1b_icedid