Behavioral task
behavioral1
Sample
2024-04-30_778de449527567046158b9d106d7731d_icedid_xiaobaminer.exe
Resource
win7-20231129-en
General
-
Target
2024-04-30_778de449527567046158b9d106d7731d_icedid_xiaobaminer
-
Size
500KB
-
MD5
778de449527567046158b9d106d7731d
-
SHA1
31275dc160cf46d1286a32ff956a072111989641
-
SHA256
ec5217c82f18582b7c05885e731a77d1b064bb064e546faca2be8ea8c123f3c7
-
SHA512
4952a4b2a8858f86cd12f79623d49ece57a1854076527e3b80df3e0661468d979c82790c57971e3f82c166951bd0b2e9eaf5fcf1ea69a9bfaa8a4389872c2af3
-
SSDEEP
6144:7+4U+1MCyr3UGv9JYB1Z3jccvQVCrnOxfPinOxatBCACGOHbR:7+YPyrSB1Z3jccvQVCrNHtBCACN9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-30_778de449527567046158b9d106d7731d_icedid_xiaobaminer
Files
-
2024-04-30_778de449527567046158b9d106d7731d_icedid_xiaobaminer.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.htext Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE