icedid | 726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233

General

Target
726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233
Size 6KB
Sample240419-vwtw2abc21
SHA256 726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233
MD5 b083c6bb35f00f27e72c9ad927347aed
SHA1 1df001abc683eef19ad83dc550b29e993aa6b329
SHA512 7c02a2a076dae668aa9a43627085af9b942f130868ae977eea18912e1ca372fcf7f51d59fe3986f3e75eba3c8dfd45aafd7119ff1584bf13918400766e3d06ad
SSDEEP 192:nL48DesHz289OkeALo7VXcbUFmUnODIqgKTxnM:nLVDeua89wAU7dVG7xnM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader 4165079571 icedid

Malware Config

Extracted

Family

icedid

Campaign

4165079571

C2

podiumstrtss.com

Signatures

Icedid family
icedid

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe

File Explorer

726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233

.zip 6KB
a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe

.dll 15KB

726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233

SHA256 726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233
MD5 b083c6bb35f00f27e72c9ad927347aed
SHA1 1df001abc683eef19ad83dc550b29e993aa6b329
SHA512 7c02a2a076dae668aa9a43627085af9b942f130868ae977eea18912e1ca372fcf7f51d59fe3986f3e75eba3c8dfd45aafd7119ff1584bf13918400766e3d06ad
SSDEEP 192:nL48DesHz289OkeALo7VXcbUFmUnODIqgKTxnM:nLVDeua89wAU7dVG7xnM
MD5 SHA1 SHA512 SSDEEP

Password

infected

a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe

IMPHASH c8c62b0edf4a5f76dfd31e8262b5adbe
SHA256 a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
MD5 06cc2fdfd408c15a1e16adfb46e8bb38
SHA1 585cfc19bdb8dfb92407e917615be1ab9dd523e5
SHA512 eb11a4b40eb20610f3296af8c8a7c8af5934e10922146fdc524b8212077025ccd22aa69e16aa38af56a86bd49aedc9a36a00a3cb7de3368b194fe9026ebb18d4
SSDEEP 192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLRP0tkYGijY5:s5Jxayczq7Yjt9lfle9s6PL16kYGi85
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.c

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

6B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.r

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.d

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233

a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe

winhttp

shell32

msvcrt

user32

kernel32

advapi32

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

726633284931ff2411cc3b2bae2e80de4548b8e5f0b9023ae147a279ca5a3233

a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe

winhttp

shell32

msvcrt

user32

kernel32

advapi32

generic