all InfoSec news
IcedID gets Loaded
Oct. 20, 2023, 5:55 p.m. | MalBot
Malware Analysis, News and Indicators - Latest topics malware.news
By: Joshua Platt and Jason Reaves
While investigating a recent IcedID campaign leveraging GitLab:
hxxps://gitlab.]com/group9652040/my1/-/raw/main/2.exe
We noticed that the imphash for the sample had an overlap with another sample:
Ref: https://www.virustotal.com/gui/search/imphash%253Ace088b62574105896ea14183bc034940/filesAnd that new sample was talking to a different domain:
Ref: https://www.virustotal.com/gui/file/6ae543b0a3380779b65bff8c3ca0267f741173aed0d35265d6c92c0298fb924c/relationsAfter unpacking the sample a few strings can be seen that would allude to some sort of system and network profiler:
&ipconfig=
&systeminfo=
&domain_trusts=
&domain_trusts_all=
&net_view_all_domain=
&net_view_all=
&net_group=
&wmic=
&net_config_ws=
&net_wmic_av=
&whoami_group=
When diving into the binary …
article blog global icedid jason link medium tech topic walmart
More from malware.news / Malware Analysis, News and Indicators - Latest topics
Malware Simulators cannot test Antivirus Software
1 day, 6 hours ago |
malware.news
FBI warns of email spoofing by North Korean threat actor Kimsuky
1 day, 12 hours ago |
malware.news
You get a passkey, you get a passkey, everyone should get a passkey
1 day, 15 hours ago |
malware.news
Jobs in InfoSec / Cybersecurity
Sr Cyber Threat Hunt Researcher
@ Peraton | Beltsville, MD, United States
Lead Consultant, Hydrogeologist
@ WSP | Chattanooga, TN, United States
Senior Security Engineer - Netskope/Proofpoint
@ Sainsbury's | London, London, United Kingdom
Senior Technical Analyst-Network Security
@ Computacenter | Bengaluru Bengaluru (Bengaluru, IN, 560025
Senior DevSecOps Engineer - Clearance Required
@ Logistics Management Institute | Remote, United States
Software Test Automation Manager - Cloud Security
@ Tenable | Israel - Office - CS