General
-
Target
icyloader.zip
-
Size
18.4MB
-
Sample
240704-qgwpvszbmc
-
MD5
65485311516f9d27e5fb722de30c1209
-
SHA1
64909a48ad2802af48948b990df88828d97198b0
-
SHA256
2630784457253085d1bfcf955643336e648f1826a60d3b6658cd1735e5490081
-
SHA512
37a3b1a4f31e341a951083bea2979af74fffaf20b596835fdb6a17b97d24c34b95ddb0f1f6dfd3851a59ad07061be65c783f9ef92478013119eb5be11f83956a
-
SSDEEP
393216:1G3dbvXbrzAJuuwqbySFSssAkXmLGzggNvuzo4PqyStpVe:k3JvX308uwvCsLzHIzrqpVe
Behavioral task
behavioral1
Sample
icyloader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
icyloader.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
icyloader.exe
-
Size
18.6MB
-
MD5
87a1d5d53368a1762fe8decccb827863
-
SHA1
4b631c8795771f67359415997486c30dce0e55c3
-
SHA256
589c258c01a882e5cb4a4c53de7f3b9d55ec9f904a787a1db759743680fb4391
-
SHA512
095027f03b79479634b8beb399919d22e1567421da099c3bc8247231e49537f90cb1b4e05b165bd48177b007f80723ae8eef125df9fd586192f167bff6b9ed6e
-
SSDEEP
393216:HqPnLFXlrP2Q8DOETgsCKfGFOgnPvE1T+d4QxWqN:KPLFXNuQhECoCU1g4IN
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1