Extracted

• • Target
    DH-1641992615.xll
  • Size 71KB
  • SHA256 b853d281151ac67a443266a399b3a8ccc427d998619b688916a59f3a5a2ada72
  • MD5 6ff89faecd175d42350061c37f882cad
  • SHA1 9d6a4702bb1fbcc8cb347114b34fab3d1d34f6a0
  • SHA512 25c52c46b454e2f582caa70c1efa0ece8533c90058b2e5106d2c57becb58465a1e0994c85969e922864cf5fc440b25ef1f2ec412fd5f709bd142ae3f74609454
  • MD5 SHA1 SHA512

  Score

  10^/10

  icedid480946516bankersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2