Behavioral task
behavioral1
Sample
2024-05-11_7fd91ee5aa5265d7c863a6dacee65230_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-05-11_7fd91ee5aa5265d7c863a6dacee65230_icedid_xiaobaminer
-
Size
3.0MB
-
MD5
7fd91ee5aa5265d7c863a6dacee65230
-
SHA1
786d28b3216fa9482622b9c4c54f2da9fc61ce3b
-
SHA256
6f3cc19abe26a0f1ccdbce003eb6b10ba7a51d1fd66c20226e3073aa542cd656
-
SHA512
e3fe6caafc5991bb5b2f310eb8136a210d41c2e0131328b4918347acf9c2e850ee2a2728ef25ff55b25a16f547fbcec12078365b3caba440741af19def3c0351
-
SSDEEP
49152:7+nenzcErNNQJIlTLpYq/+V67D4lTegjI45TMwwapIgTI:cE62aMLapI9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-11_7fd91ee5aa5265d7c863a6dacee65230_icedid_xiaobaminer
Files
-
2024-05-11_7fd91ee5aa5265d7c863a6dacee65230_icedid_xiaobaminer.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.htext Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE