icedid | a3aa724dbfe8d66266d2a4a8cd7982442a3416d792529cff9751bb4e69f9ca81 | Triage

Sharing

General

Target

JaffaCakes118_a3aa724dbfe8d66266d2a4a8cd7982442a3416d792529cff9751bb4e69f9ca81
Size

617KB
Sample

241222-yetfqawrgy
MD5

0581e7a38780ac849064cf4e5e84d7ca
SHA1

16bb43f4b7a3880b41fdb011452e10920b5c6f59
SHA256

a3aa724dbfe8d66266d2a4a8cd7982442a3416d792529cff9751bb4e69f9ca81
SHA512

162a2a908f625d61bd3c6fe89f4cb9e4923a433526ccc4deb9f5e08e30748a7868c826dbfd47dd45dd213dbbf30440d6f083b51bc775085c63668ea7536b3fad
SSDEEP

12288:fQHrRbsTP9qoTVIj8xjmHFlmxQIDbrlknec04kRdd8jQUsdhbY0btK28:f+9bEpVs8EHHjyrl+3ETyjQ7Dov

Score

10^/10

icedid 3415411565 banker core_loader core_payload trojan

Malware Config

Extracted

Family

icedid

Botnet

3415411565

C2

antnosience.com

seaskysafe.com

Attributes

auth_var
1
url_path
/news/

Extracted

Family

icedid

rsa_pubkey.plain

Targets

- Target
  
  core.bat
- Size
  
  184B
- MD5
  
  4da584cc0a5ded0c902627093ab8721b
- SHA1
  
  a6bb30b50718813a72cbd58ba148bc3c9a17c3f0
- SHA256
  
  bcc176e2ec1bddb1518bcacb07fef99fe1812e204e990424549f11862aaa757c
- SHA512
  
  d611696d95dd76f1c3f7ab90c370ccb734f1912ff340d28c5a050d0fb072c7914c3bd15ea30f8f2873fdb17f0b93da92eaa7eecc3b245e23c972c700777be804
Score

10^/10

icedid 3415411565 banker core_loader core_payload trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Icedid family
  icedid
behavioral1 behavioral2
- Target
  
  planet64.tmp
- Size
  
  595KB
- MD5
  
  c4a6cc66cad9a955f6fbd6ff6ec7f804
- SHA1
  
  c06164863328cc0628b5fef8f41f3971244e4d49
- SHA256
  
  5537366f1715dd509a927e3a0e7b37b51ca1ed289c81da7d6cf2c21f8ad50b7d
- SHA512
  
  66d6adc87d097c509a4f71bc71247b7e42fa0ad6ae3e9df9325ee97d3de79048e41f248b8c2a288dbf9bc70f066529a0542031eb5d52bdf320c3cda713d34867
- SSDEEP
  
  6144:0chMqY+yya01Gks7/bRWTU2dA9AXu9b1ohrnlFV+I9b/AnK3+QKStcGV/:EX+ylbpJ2dAAu9poOa+ut
Score

10^/10

icedid 3415411565 banker core_loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Icedid family
  icedid
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid3415411565bankercore_loadercore_payloadtrojan

behavioral2

icedid3415411565bankercore_loadercore_payloadtrojan

behavioral3

icedid3415411565bankercore_loadertrojan

behavioral4

icedid3415411565bankercore_loadertrojan