2024-04-21_a4203f9fafc4bfee923c6d00e689d875_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-21_a4203f9fafc4bfee923c6d00e689d875_icedid
Size

864KB
MD5

a4203f9fafc4bfee923c6d00e689d875
SHA1

014344a3ab9eca1b9b7a69743eca4da4df7c4ccb
SHA256

f95f8c28558b2f1eb68bc0e3635078697a5b52e6fd714910446ec986513499f9
SHA512

6c312de1bec8df1d872109d0dddb84b743dfb2ddd34fc08fcce3f945e0fbdd70fb73ffdca03fd70e03d6f3d4dafff227cdd3a17fb998f11eb7e0547cde4c8c4d
SSDEEP

24576:vRWcU7k1r3XADjCTHszGHsngtvspGGv6eWSKHqoOawNJ91n8XNDUN:beWLH7OB9iNDUN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-21_a4203f9fafc4bfee923c6d00e689d875_icedid

Files

2024-04-21_a4203f9fafc4bfee923c6d00e689d875_icedid
.exe windows:4 windows x86 arch:x86

96c5fd37f66b1c38f7b253cbec2f9d4f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\MTK_Release\GN Imeitool\GN_QC_EG_WRTIMEI\bin\release\Imeitool.pdb

Imports

at_commanddll

?ATGetVersion@CATCommand@@QAEHHPAD@Z
?ATReadIMEI@CATCommand@@QAEHHPADH@Z
?ATWriteIMEI@CATCommand@@QAEHPADH@Z
?ATReset2Factory@CATCommand@@QAEHXZ
?ATResetPhone@CATCommand@@QAEHXZ
?ATReadBarcode@CATCommand@@QAEHHPAD@Z
ord2
?ATEnableECHO@CATCommand@@QAEHH@Z
?ATEnabaleSleepMode@CATCommand@@QAEHH@Z
ord1

kernel32

GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
SetStdHandle
GetFileType
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
LCMapStringA
LCMapStringW
GetTimeZoneInformation
SetHandleCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
VirtualAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
WideCharToMultiByte
SizeofResource
SetEvent
GetFileAttributesA
InterlockedExchange
CompareStringW
GetVersion
CompareStringA
MulDiv
LocalFree
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualProtect
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
GetFileTime
LeaveCriticalSection
LocalAlloc
LockResource
LoadResource
FindResourceA
OutputDebugStringA
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
lstrlenA
MultiByteToWideChar
FormatMessageA
InterlockedDecrement
CreateSemaphoreA
GetLastError
CloseHandle
Sleep
WaitForMultipleObjects
CreateEventA
ResetEvent
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
SetCurrentDirectoryA
LoadLibraryA
FreeLibrary
GetProcAddress
GetTickCount
InterlockedIncrement
CreateThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetACP
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GetCurrentProcessId
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetModuleHandleA
GetVersionExA
SetLastError
GlobalFree
WaitForSingleObject

user32

GetWindowThreadProcessId
SetRectEmpty
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
IsWindowEnabled
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
GetCursorPos
WindowFromPoint
ClientToScreen
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
IsZoomed
GetParent
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
GetActiveWindow
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
SetCursor
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
MapDialogRect
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
SetWindowContextHelpId
RegisterClipboardFormatA
DestroyMenu
LoadCursorA
GetDCEx
LockWindowUpdate
SetCapture
ReleaseCapture
GetWindowRect
OffsetRect
GetSysColor
InflateRect
EnableWindow
GetClientRect
IsIconic
SendMessageA
GetSystemMetrics
DrawIcon
InvalidateRect
GetWindow
GetDesktopWindow
IsWindow
GetPropA
ShowWindow
SetForegroundWindow
LoadIconA
GetSysColorBrush
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
IsWindowVisible
PostMessageA
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuA
GetMenuItemID
GetMenuItemCount
GetSubMenu
CharUpperA
SetRect
GetWindowTextA
CopyRect
CheckMenuItem
GetMenu
SetPropA
GetMenuState
LoadBitmapA
RemovePropA
GetDlgItem
SetTimer
KillTimer
EnableMenuItem
UpdateWindow
CharNextA
CopyAcceleratorTableA
IsRectEmpty
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
PostThreadMessageA
UnregisterClassA
SetParent

gdi32

SetTextColor
SetBkColor
GetBkColor
SaveDC
RestoreDC
SetBkMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
DeleteObject
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetTextMetricsA
SetRectRgn
CombineRgn
GetMapMode
PatBlt
GetTextColor
GetRgnBox
CreateBitmap
CreateCompatibleDC
CreateRectRgnIndirect
CreateCompatibleBitmap
BitBlt
GetStockObject
CreateSolidBrush
CreateFontA
CreateFontIndirectA
GetObjectA
CreatePen
GetTextExtentPoint32A
GetDeviceCaps
GetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegEnumValueA
RegCloseKey

shell32

ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA

oledlg

ord8

ole32

CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
OleRun
CoCreateInstance
CoTaskMemAlloc
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

VariantInit
VariantCopy
VariantClear
VariantChangeType
SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
GetErrorInfo

gn_getphoneinfo

ord1
?IsPhoneConnected@CPhoneInfo@@QAEHXZ
ord2
?RebootPhone@CPhoneInfo@@QAEHXZ
?GN_Efs2SyncWithWait@CPhoneInfo@@QAEHXZ
?OpenPort@CPhoneInfo@@QAEHFW4LibMode@@@Z
?ClosePort@CPhoneInfo@@QAEHXZ
?info_GetSN@CPhoneInfo@@QAEHPADPAH@Z
?info_SetIMEI@CPhoneInfo@@QAEHPAD@Z
?info_SetIMEI1@CPhoneInfo@@QAEHPAD@Z
?info_SetIMEI2@CPhoneInfo@@QAEHPAD@Z
?info_GetIMEI@CPhoneInfo@@QAEHPADPAH@Z
?info_GetIMEI1@CPhoneInfo@@QAEHPADPAH@Z
?info_GetIMEI2@CPhoneInfo@@QAEHPADPAH@Z
?info_SetMEID@CPhoneInfo@@QAEHPAD@Z
?info_GetMEID@CPhoneInfo@@QAEHPAD@Z
?info_SetWifiMAC@CPhoneInfo@@QAEHPAD@Z
?info_GetWifiMAC@CPhoneInfo@@QAEHPAD@Z
?info_GetSWVersion@CPhoneInfo@@QAEHPADPAH@Z
?info_GetAPSWVersion@CPhoneInfo@@QAEHPADPAH@Z
?info_GetFactoryStatus@CPhoneInfo@@QAEHPADPAH@Z

phonecommand

SP_Write
SP_SetProperty
SP_BeginPhoneTest
SP_FastReadNvInfo
SP_FastWriteNvInfo
SP_NvWriteDirect
SP_SendATCommand
SP_FastReadVersion
SP_GetUsbPort
SP_StopModeProcess
SP_EndPhoneTest
SP_ReleasePhone
SP_CreatePhone
SP_GetMsVersion
SP_EnterModeProcess
SP_ReadSN
SP_LoadCaliAndTestFlag
_SP_SetUsbAutoMode@8

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

meta_app

ord40
ord1
ord4
ord6
ord2
ord181
ord182
ord31
ord41
ord5
ord3

meta_dll

ord722
ord1376
ord290
ord288
ord724

eboot

ord61
ord62
ord17
ord2

spmeta_dll

ord54
ord48
ord4
ord216
ord5011
ord50
ord202
ord2
ord5065
ord87
ord7
ord2906
ord206
ord208

writeread_dll

?GetCBPVersion@ViaIfPro@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?WriteMEID@ViaIfPro@@QAEHV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?ClosePort@ViaIfPro@@QAEXXZ
?ReadMEID@ViaIfPro@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?ReadBarcode@ViaIfPro@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?OpenPort@ViaIfPro@@QAEHHIV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?ClearCPPower@ViaIfPro@@QAEXXZ
ord2
ord1
?ReadSIDBFlag@ViaIfPro@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?CheckMobileConnection@ViaIfPro@@QAEHXZ
?ReadBlueTooth@ViaIfPro@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

Sections

.text
Size: 668KB - Virtual size: 664KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96c5fd37f66b1c38f7b253cbec2f9d4f

Headers

File Characteristics

PDB Paths

Imports

at_commanddll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gn_getphoneinfo

phonecommand

version

meta_app

meta_dll

eboot

spmeta_dll

writeread_dll

Sections

.text Size: 668KB - Virtual size: 664KB

.rdata Size: 144KB - Virtual size: 142KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 32KB - Virtual size: 28KB

.text
Size: 668KB - Virtual size: 664KB

.rdata
Size: 144KB - Virtual size: 142KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 32KB - Virtual size: 28KB