2024-05-29_bf8378c9544ad6a175dbe2fb360fcf08_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-29_bf8378c9544ad6a175dbe2fb360fcf08_icedid
Size

784KB
MD5

bf8378c9544ad6a175dbe2fb360fcf08
SHA1

d2a342c4f4ce1540f2b5485bcae13410934eb00a
SHA256

c88a7a22869ce7a6434598e0be1e5f7a70952e434fd0e3bdd2b6cd29c2b5438f
SHA512

26c0b7ad15239dd1e36da9ff72caf9d174e777505a0ba7b12eb6804b59c036a0998784954cb40c60b6ef0bf3216a553fc5c0ccc470ec74e943b435f05b9771d8
SSDEEP

12288:3UUUsHy7HkbtVFgv/Iv2HuVpkvg+DPU71lhvQZqYFPzwHO:3UXrkbHFgv/Ivau/kvDs71lhvQgYF7wu

Score

1^/10

Malware Config

Signatures

Files

2024-05-29_bf8378c9544ad6a175dbe2fb360fcf08_icedid
.exe windows:5 windows x86 arch:x86

82178b281971beee62657defe5d9d11f

Code Sign

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

01/01/2021, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7b:69:d6:4d:6b:f1:18:0d:b1:d4:9f:97:18:3b:2b:e4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/03/2015, 00:00

Not After

02/03/2016, 23:59

Subject

CN=LogOnNet Co.\,Ltd.,O=LogOnNet Co.\,Ltd.,L=Geumcheon-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:a3:d9:3d:cf:30:9a:a7:df:60:ef:f6:df:f0:9c:e6:c0:db:80:16
Signer

Actual PE Digest

77:a3:d9:3d:cf:30:9a:a7:df:60:ef:f6:df:f0:9c:e6:c0:db:80:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathStripToRootA
PathIsUNCA
UrlUnescapeA
PathFindExtensionA
PathFindFileNameA

kernel32

TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
GetFileSizeEx
GetFileTime
SetErrorMode
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
ExitThread
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
HeapReAlloc
VirtualQuery
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
HeapCreate
SetHandleCount
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
TlsAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetModuleFileNameA
GetPrivateProfileStringA
GlobalHandle
GlobalReAlloc
TlsGetValue
GetModuleHandleW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
GetPrivateProfileIntA
CreateMutexA
GetLastError
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesA
CreateFileA
GetFileSize
ReadFile
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageA
lstrlenA
LocalAlloc
GetLongPathNameA
OutputDebugStringA
GetFileAttributesExA
lstrlenW
FreeLibrary
LoadLibraryA
GetProcAddress
GetTickCount
GetLocalTime
WritePrivateProfileStringA
GetVersionExA
GetCurrentProcess
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WriteFile
GetSystemDirectoryA
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
DuplicateHandle
UnlockFile
LockFile
SuspendThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GetModuleFileNameW
GetCurrentProcessId
VirtualFree
VirtualAlloc
GetStdHandle
SetEndOfFile
SetFilePointer
LoadLibraryExA
HeapAlloc
HeapFree
GetVolumeInformationA
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeA
CreateThread
GetModuleHandleA
SetLastError
Sleep
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetWindowsDirectoryA
FindClose
FindFirstFileA
ResetEvent
SetEvent
FreeResource
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventA
GetVersion
IsWow64Process

user32

RegisterClipboardFormatA
UnregisterClassA
GetSysColorBrush
GetMenuItemInfoA
CharUpperA
UnpackDDElParam
ReuseDDElParam
ReleaseCapture
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
TranslateAcceleratorA
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
SetPropA
GetPropA
RemovePropA
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
CallWindowProcA
GetMenu
IntersectRect
IsIconic
UnhookWindowsHookEx
SetWindowPos
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
SendMessageA
SystemParametersInfoA
GetSystemMetrics
SetTimer
GetWindowTextLengthA
GetWindowTextA
GetWindow
SetFocus
GetLastActivePopup
MessageBoxA
EndPaint
BeginPaint
GetWindowDC
ScreenToClient
GetMenuState
GetMenuStringA
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
EndDialog
GetWindowPlacement
ShowWindow
PostQuitMessage
PtInRect
PeekMessageA
GetFocus
GrayStringA
DrawTextExA
TabbedTextOutA
DrawTextA
SetRect
GetMenuItemCount
TrackPopupMenu
ModifyMenuA
GetMenuItemID
GetCursorPos
SetMenuDefaultItem
GetSubMenu
IsWindow
RedrawWindow
FillRect
LoadBitmapA
GetClientRect
ReleaseDC
KillTimer
GetClassLongA
EnableWindow
LoadCursorA
FindWindowA
UpdateWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
BringWindowToTop
RegisterWindowMessageA
FindWindowExA
PostMessageA
LoadIconA
GetAncestor
GetClassNameA
MonitorFromWindow
GetMonitorInfoA
GetDesktopWindow
GetWindowRect
DestroyMenu
GetClassInfoA
DefWindowProcA
DestroyIcon
GetWindowLongA
IsWindowVisible
GetNextDlgTabItem
GetParent
SetCursor
InvalidateRect
ClientToScreen
WindowFromPoint
GetActiveWindow
CopyRect
OffsetRect
InflateRect
FrameRect
LoadMenuA
LoadImageA
GetDC
GetSysColor
DrawStateA

gdi32

SetWindowExtEx
ScaleWindowExtEx
CreatePatternBrush
SetWindowOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
RectVisible
SelectClipRgn
MoveToEx
LineTo
GetClipBox
SetMapMode
SetBkMode
RestoreDC
SaveDC
Rectangle
GetTextExtentPoint32A
Escape
ExtTextOutA
DeleteDC
PtVisible
CreateRectRgn
CreatePen
GetDeviceCaps
CreateFontIndirectA
SetPixel
GetPixel
CreateFontA
SetTextColor
SetBkColor
SelectObject
GetObjectA
CreateBitmap
CreateCompatibleDC
BitBlt
CreateSolidBrush
GetStockObject
DeleteObject
CreateCompatibleBitmap
TextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
DuplicateTokenEx
CreateProcessAsUserA
AdjustTokenPrivileges
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenSCManagerA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
StartServiceA
CloseServiceHandle
QueryServiceStatus
OpenServiceA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteExA
DragFinish
DragQueryFileA

comctl32

_TrackMouseEvent

ole32

CoUninitialize
CoInitializeEx
CLSIDFromProgID
CoCreateInstance

oleaut32

SysStringByteLen
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
GetErrorInfo
SysAllocStringByteLen

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

pdh

PdhCloseQuery
PdhGetFormattedCounterValue
PdhAddCounterA
PdhCollectQueryData
PdhOpenQueryA

wininet

HttpSendRequestA
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetSetOptionExA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetGetConnectedState
InternetReadFile
HttpQueryInfoA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetCloseHandle
InternetAttemptConnect
HttpAddRequestHeadersA

Sections

.text
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 365KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82178b281971beee62657defe5d9d11f

Code Sign

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7b:69:d6:4d:6b:f1:18:0d:b1:d4:9f:97:18:3b:2b:e4Certificate

Extended Key Usages

Key Usages

77:a3:d9:3d:cf:30:9a:a7:df:60:ef:f6:df:f0:9c:e6:c0:db:80:16Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

userenv

pdh

wininet

Sections

.text Size: 321KB - Virtual size: 320KB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 11KB - Virtual size: 39KB

.rsrc Size: 365KB - Virtual size: 364KB

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7b:69:d6:4d:6b:f1:18:0d:b1:d4:9f:97:18:3b:2b:e4
Certificate

77:a3:d9:3d:cf:30:9a:a7:df:60:ef:f6:df:f0:9c:e6:c0:db:80:16
Signer

.text
Size: 321KB - Virtual size: 320KB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 11KB - Virtual size: 39KB

.rsrc
Size: 365KB - Virtual size: 364KB