icedid | 1932d19d945872277b69ad2bdca6224881965abb1241a79268135d7c573b4df1 | Triage

Sharing

General

Target

JaffaCakes118_1932d19d945872277b69ad2bdca6224881965abb1241a79268135d7c573b4df1
Size

382KB
Sample

241222-dpeebs1per
MD5

e04a50f2fb6a7db63e2149a24a2f39a8
SHA1

372e860a63a0694231e47b1d3ccde5636d1fa636
SHA256

1932d19d945872277b69ad2bdca6224881965abb1241a79268135d7c573b4df1
SHA512

dc35c20b46cce7fd7709916f30af2345ef5172b780e1aa1c3420023ee9c63a855227288a7e6097d4daf5afe19a64cf807a88b0b8e5af1ff379f00f18ec6a87a2
SSDEEP

6144:lOfzMdUik1UuZrPmI/jPsuCe2e7Bxq6G7dOwxZWIxjCQ+vOYA/A4:KDik1fZrHLsw7BIHZxjkbA44

Score

10^/10

icedid 1217670233 banker core_loader core_payload trojan

Malware Config

Extracted

Family

icedid

Botnet

1217670233

C2

nnelforwfin.top

lakogrefop.rest

hangetilin.top

follytresh.co

Attributes

auth_var
12
url_path
/posts/

Extracted

Family

icedid

rsa_pubkey.plain

Targets

- Target
  
  core.bat
- Size
  
  184B
- MD5
  
  2b4f27b826aec08eb90ff784b25d048d
- SHA1
  
  b1444548b53ec112797cc7d03a1e227fe71315ca
- SHA256
  
  b976471778c3abead8001c5a7db7d39b461e88bbd5322a579d86c1ca725375fb
- SHA512
  
  d6316825b5372e445941b75b08b04aaee49bab12d752dba4691aac8093100d1632a1b07e6b7d6899c528e6777f0bcfcd977e02a7f8d559b29e205703f573d434
Score

10^/10

icedid 1217670233 banker core_loader core_payload trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Icedid family
  icedid
behavioral1 behavioral2
- Target
  
  pigeon64.dat
- Size
  
  159KB
- MD5
  
  de317e8f5ed28affbf38306925aa59a8
- SHA1
  
  38f670fadedf06bf12243b74618c5e4461416a6f
- SHA256
  
  b16bfd48ebbe416330327d2462bb5084bf0e3dfadd237b10e0c4670ed52532ef
- SHA512
  
  c9b02fa7effaeba55d1f324da2557c210b04b031991b1909d85dde90fed162d3c3afa8325ec96cd52f306074def915bf7c99e361502fea920bb33f68f322abce
- SSDEEP
  
  3072:Rgdn2kM3jGZuKnK8nqYLMZsylF9nmV0snOJVWHTSNV:RxkAjBK17sNNV
Score

10^/10

icedid 1217670233 banker core_loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Icedid family
  icedid
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid1217670233bankercore_loadercore_payloadtrojan

behavioral2

icedid1217670233bankercore_loadercore_payloadtrojan

behavioral3

icedid1217670233bankercore_loadertrojan

behavioral4

icedid1217670233bankercore_loadertrojan