Extracted

• • Target

    2025-02-13_90fed2855f0003495ff60d47ddad14a8_icedid

  • Size

    456KB

  • MD5

    90fed2855f0003495ff60d47ddad14a8

  • SHA1

    c5963014a06d55ab68ee393c0fd255fe9244d3b0

  • SHA256

    4e8029a6c642310474a2baf6a1b0f655856ca39c5b944247435c0ee6daf16c8f

  • SHA512

    8290dd62e2c79e5e6d848633fd2cdf73940f27e71e0c4d8e16588d67f82c9f7945f24f1898a27d9e2e04afe2a2319d52497e66b4aa8ac0e2979af450a2238f9a

  • SSDEEP

    12288:sH9tNCsqbIoCyJgllh/krhMQUqKsRR2B9:ytEfbjJglvqyB9

  Score

  10^/10

  emotetepoch1bankerdiscoverytrojanadwarepersistenceprivilege_escalationstealer

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Emotet family

    emotet

  • Emotet payload

    Detects Emotet payload in memory.

    trojanbanker

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2