2e22b99caa901311372998458c729ff0f7c57962b7e9cd124fa82205c3606808

General

Target
2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid
Size 5.5MB
Sample260711-carknscx4x
SHA256 2e22b99caa901311372998458c729ff0f7c57962b7e9cd124fa82205c3606808
MD5 0a9ec3eb11111a1a9f67bafda38cdd62
SHA1 6a49107f6e4f665cca6b7c54620745da4bd452ef
SHA512 b80b4f08e29e6ceceffbf1404084241b66743d1368621790b340084aabde4f2d0d4a713ec4955147d208081fd92847e6df45f5c1a63450f8517d6a2ac25dcc23
SSDEEP 98304:2YQZgmFNtgF26ox1qgIk6m0RknUSxZWWjeHa/M1Megn:FQXqhoqk30RlSxZPM1Me6
TLSH
T1FE46E19666AC40F8D267C138C8124A4BE7F2F8510B31C7EF11A55B6E5F777A20D2A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid
- Size 5.5MB
- SHA256 2e22b99caa901311372998458c729ff0f7c57962b7e9cd124fa82205c3606808
- MD5 0a9ec3eb11111a1a9f67bafda38cdd62
- SHA1 6a49107f6e4f665cca6b7c54620745da4bd452ef
- SHA512 b80b4f08e29e6ceceffbf1404084241b66743d1368621790b340084aabde4f2d0d4a713ec4955147d208081fd92847e6df45f5c1a63450f8517d6a2ac25dcc23
- SSDEEP 98304:2YQZgmFNtgF26ox1qgIk6m0RknUSxZWWjeHa/M1Megn:FQXqhoqk30RlSxZPM1Me6
- TLSH
  T1FE46E19666AC40F8D267C138C8124A4BE7F2F8510B31C7EF11A55B6E5F777A20D2A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan upx
- UAC bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2