General

  • Target

    2024-10-24_6273d95f39827602717d8664c9082de4_hijackloader_icedid

  • Size

    2.8MB

  • Sample

    241024-he96gazbjn

  • MD5

    6273d95f39827602717d8664c9082de4

  • SHA1

    64a32cf4c39341009f1fc8ee676fb35ea26d4db6

  • SHA256

    d050b6dde018c996d377700dd2432594cb9f72b96be82b2ebf240ffb2a8b5c2b

  • SHA512

    0034d24d57ffe979dd401d04beafa922f7526f5f98a1f84f5b5a12d56c6a4af9d999ad776dec23446dea726f68b5a39ca2a3a051316a9dbb7442274e5fb162d3

  • SSDEEP

    24576:wl18GADX15DihL9GVRqIERogW68ngSTeTm8HZfj4cCao6A6u2EmAOuydnTX2tuiz:wO7SL9eq67ydBC/S2mpTn9

Malware Config

Targets

    • Target

      2024-10-24_6273d95f39827602717d8664c9082de4_hijackloader_icedid

    • Size

      2.8MB

    • MD5

      6273d95f39827602717d8664c9082de4

    • SHA1

      64a32cf4c39341009f1fc8ee676fb35ea26d4db6

    • SHA256

      d050b6dde018c996d377700dd2432594cb9f72b96be82b2ebf240ffb2a8b5c2b

    • SHA512

      0034d24d57ffe979dd401d04beafa922f7526f5f98a1f84f5b5a12d56c6a4af9d999ad776dec23446dea726f68b5a39ca2a3a051316a9dbb7442274e5fb162d3

    • SSDEEP

      24576:wl18GADX15DihL9GVRqIERogW68ngSTeTm8HZfj4cCao6A6u2EmAOuydnTX2tuiz:wO7SL9eq67ydBC/S2mpTn9

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Sets service image path in registry

    • Stops running service(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks