Overview

overview

10

Static

static

10

2024-08-25...id.exe

windows7-x64

10

2024-08-25...id.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-08-25_ec380602cd1815803a71fe93c54638bf_icedid

  • Size

    3.4MB

  • Sample

    240825-mfyw2syhrc

  • MD5

    ec380602cd1815803a71fe93c54638bf

  • SHA1

    c9e526d15cef4cdb8cd853a66adb7cc240446c90

  • SHA256

    902cea489e8363193904fd6dca8b5d4939d1e00fbfa2a7fad7c8cf9288098d27

  • SHA512

    75fdb0555adb9f15c6f079a54e1792768b1d6faf7a2db00c5c3fd2f63bf4a4d66afe08c0236a5420ceeecff5099960eccedbdcb3b03e3a561dd99d3291d152f1

  • SSDEEP

    49152:8Xt3tH1bHKHZd/fcB2gZvckHgWCWXTE7TqEvA6VbpNPJvyteA9Zgi7cdEG:y9VbHK5eGkHgW7XTRERxJasQi

Score
10/10
blackmoonbankerbootkitdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      2024-08-25_ec380602cd1815803a71fe93c54638bf_icedid

    • Size

      3.4MB

    • MD5

      ec380602cd1815803a71fe93c54638bf

    • SHA1

      c9e526d15cef4cdb8cd853a66adb7cc240446c90

    • SHA256

      902cea489e8363193904fd6dca8b5d4939d1e00fbfa2a7fad7c8cf9288098d27

    • SHA512

      75fdb0555adb9f15c6f079a54e1792768b1d6faf7a2db00c5c3fd2f63bf4a4d66afe08c0236a5420ceeecff5099960eccedbdcb3b03e3a561dd99d3291d152f1

    • SSDEEP

      49152:8Xt3tH1bHKHZd/fcB2gZvckHgWCWXTE7TqEvA6VbpNPJvyteA9Zgi7cdEG:y9VbHK5eGkHgW7XTRERxJasQi

    Score
    10/10
    blackmoonbankerbootkitdiscoverypersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks