IcedID - это банковский троян, который позволяет злоумышленникам использовать его для кражи банковских реквизитов жертв. IcedID aka BokBot в основном нацелен на бизнес и крадет платежную информацию, он также действует как загрузчик и может доставлять другие вирусы или загружать дополнительные модули.
Indicators of Compromise
Domains
- alcatrazsecurity.co.za
- bellazami.com
- bologna.epu.edu.iq
- casababadenopal.com
- chasehomes.ae
- corporacioncatverde.org
- fontswiki.com
- hanbro.in
- hypermeals.in
- ironreward.com
- kntelecom.pro.br
- lahigram.ir
- nopaltepec.gob.mx
- ourbimi.com.mx
- productupdate.net
- softgro.com
- synagoguecityministries.org
- tast-sv.com
URLs
- http://193.168.141.169/EAgTzBF/mesoc
- http://198.98.61.173/Ftn/arcua
- http://89.147.111.46/gWUA/Enven
- http://89.147.111.46/gWUA/hyper
- http://aptekoagraliy.com/
- https://alcatrazsecurity.co.za/onte/?86550431
- https://bellazami.com/ugae//?ltlr=1697484862
- https://bellazami.com/ugae/?91270431
- https://bologna.epu.edu.iq/dn//?1bAp=1697475810
- https://bologna.epu.edu.iq/dn/?EHCEVSMzlJLfeIKyLSMuFUOlajNhYjpbtCHyfAghHRIBjiDUBvUzCBwHEcer
- https://casababadenopal.com/aot//?uh=1697475793
- https://casababadenopal.com/aot/?hEtquyqHMtHcytmagomjxYzXrzkujAUaTvLHbLYWHuHxJkcEtoDPEtgpwFqZtMmuJ
- https://chasehomes.ae/ier//?jQp=1697475774
- https://chasehomes.ae/ier/?EDxReCGwsezMOBzauE
- https://corporacioncatverde.org/mtt//?SrnQpSD=1697484856
- https://corporacioncatverde.org/mtt/?84370431
- https://fontswiki.com/ubu//?DrYtq3=1697484857
- https://fontswiki.com/ubu/?31680431
- https://hanbro.in/cu/?18650431
- https://hypermeals.in/tr/?65550431
- https://ironreward.com/ri//?SrglytJQZ=1697484857
- https://ironreward.com/ri/?99370431
- https://kntelecom.pro.br/mao//?LVD=1697484858
- https://kntelecom.pro.br/mao/?58170431
- https://lahigram.ir/eu//?ZodUKVT0w7Z=1697484857
- https://lahigram.ir/eu/?15550431
- https://nopaltepec.gob.mx/ipit//?n65c=1697475775
- https://nopaltepec.gob.mx/ipit/?XiRHKPHksekZcxqOMgqgqAwTvkJNKwZMIXMCUynQxaAehhgPeBciGxuDo
- https://ourbimi.com.mx/aaev//?Is=1697484856
- https://ourbimi.com.mx/aaev/?42370431
- https://productupdate.net/aman//?3rQ=1697475774
- https://productupdate.net/aman/?qypGjYcZAbovGiaEBcaLUCyRTcPAXEAJhXUljkKlWPRypWVBxmmAMaZyYIlGtTlYXZvUljJvGFXdQpCuzRz
- https://softgro.com/aumd/?51850431
- https://softgro.com/aumd/?54550431
- https://synagoguecityministries.org/uis//?vwufAQIeC1xR=1697484858
- https://synagoguecityministries.org/uis/?82750431
- https://tast-sv.com/ag//?Pc6pJeFp7ME=1697475774
- https://tast-sv.com/ag/?kIYJOHlOQxbFiIKvloEyEDnsMBnafa
- https://videfi.org/rmon/?vfUqXHduAVwnbKLIvTlaCazWkPZqrI
Emails
- 7e4dilatmh@gallinassociates.com
- ab.sunday@mpb.ng
- ablseirinu.ha@abhayaby.com.adomainscan.com
- accounts.fossilbeauty@fossilcote.com
- adobrem@creeksidechristmas.co.uk
- ailmluh@aspireeducation.org.in
- aonbgr@bsc.gov.bd
- backing@ucasti.net
- bdeuquug@hayatprefabrik.com.tr
- bgrady@texgel.cl
- bhansen@mfeczadeposu.com
- calpnmieh@rossyglamoursalon.com
- crm.odnabjiaao@pastelero.com.mx
- ctorphy@creat-style.com
- danhf.aksnor@contextanalysis.com.ng
- daniel.francis@paperclip.pk
- dikatorcn@deride.id
- dschinner@dpsindore.org
- e.gahierregln@eps-alain.ae
- e.hviroaeergx@think4india.com
- etilzlt@seobws.com
- gucemsmltv.nioeit@goldenheavencompanyltd.com
- hb9ekc@glutte.ch
- hddt.cimcosniim@cohico.com
- hrm.actasayg@thebernscompany.com
- httmsinc@jorimts.com
- info@alopsy.help
- info@kukki.com.tr
- info@quratulaing.com
- irosenbaum@sorbetescbx.com
- jgoyette@magentoegypt.com
- jvan59@suddenlink.net
- kcorkery@patala.id
- kfahey@iberomx.com
- kvandervort@instrukcijezaglavointelo.si
- l4yal@demo.99mountains.com
- lage5h4ir@rosasnash.com
- lcollier@dockdispatchers.com
- lialragchel.ek@dailymailupdate.com
- mhymitas@sarton.com.br
- milos.gatci@datagram.sk
- n86oypat@true-pd.com
- ntt30yrbai@pracsltd.com
- richard@mightypros.com
- sakrlkeus@nzshoppingzone.com
- sbraun@valadinfotech.com
- skghtuee.lclis@traco.com.tr
- sthompson@accurateheatingandacrepairkentwa.com
- t4bre5aal@nbhh.ae
- timeon54grn@technozain.com
- togleitab.lmlcia@langeley.esc.edu.ar
- trat31us@diversitychristianity.org
- udoyle@5str.xyz
- upholding@stengjeans.com
- urehntr@regalpan.ro
- wehreg@comrec-development.com
- workgmsat.iratez@akshartours.com
- yasmin.zavaleta@mielmex.com
- ygclrdoa@ipas-edu.org
- yis0412@jbch.org
- yllbnlenodib.y@globalevents.cc
- yst.aohmdirriaen@basilleum.pl
- ziakruam@maribgroup.com
MD5
- 01098d2c914301edc5bc01f09f72d3df
- 0769259835884a10871f2d5ccaa7385f
- 08a1033196e25823df6c17ece99cc613
- 0c9c65fdf470f80cdb3646bb9c90763e
- 0db586d3961d58cf37969a3b5f141004
- 16324d72dfca5a026232e3caec8d99ef
- 238e5f91d2dae220e732b678efb05c5c
- 26674ede90a832074a9127df55b222dd
- 2cb403372743f2d6fe43e062701b3b27
- 2d89d348fe0d9a7c437c8352289c0324
- 37d65c28b3b3a361c285ff720515de9a
- 386b8a75b187c08bc6813dd0ac626d03
- 44945569cc45b78dc9c5ee5db36de636
- 482665ec0d8973a7588f8708ea5c533d
- 487ad5736c173c8fb03b2eeb037c2a98
- 512ce07aed08040beccc0660e272b31f
- 5590d80e55e894180d29efdbe53f436c
- 5f1ba235641b3ee614d24cc8ce3db6ea
- 6a11c9f6a63b74ff694ab3a042e8d944
- 6b152dea619035cbb0b1068ac8390fe0
- 7548a9fd1686a34cbef59839e2c743b4
- 876d6aae62c31ff556739e44e5db2335
- 8c56b9d8408f934affef69118573f877
- 955e98650a404e7ae835eb85b32e81a5
- 969f2ec5a3ca7e88e6084e169308e1fb
- 96adf374da293a9113976f4a29f9a15a
- 9935a6efbb7b81c5a2e9a361adba10bf
- bb25fd038c5f75c0d3f69237643a9619
- bda6c79a458c486a82f55e620653019e
- c6cb45077fe20e3a8f5f5cf32023a10d
- cdf9a66c5d54f042211b27e406d72ae0
- d081f662450b8b09c055cfe9ad1365c9
- d0a9c76dcd96c9c6194ea183e5d25f9e
- d1094d2dfc4ad224908ef892c275bf0c
- dac5d6d4b22dd9909ac8b4859563653d
- e18c84f27f49bf07afdf7dd490b3ce93
- f33006f8b07590baaabd9c77f4a06d1d