IcedID (BankBot) Trojan IOCs

IcedID, также известный как BokBot, представляет собой модульный банковский троян, который нацелен на финансовую информацию пользователя и способен работать в качестве дроппера для других вредоносных программ. Он использует атаку типа "человек в браузере" для кражи финансовой информации, включая учетные данные для входа в сеансы онлайн-банкинга.

Содержание

Indicators of Compromise

Domains

alldogsedag.com
cansugperpetu.com
cuentademo.info
garbagewellduno.com
hdgravity.com
hdtrenity.com
morginakolim.com
tritehairs.com

URLs

http://138.124.183.22/nurma/ugO4bFdrgP7n7tpB8H7ZvcObluYiKNRq7w~~/hL3f5Cby3E8rsU1BFB3N04PGtrE4MeFyxw~~/
http://blazzerneumi.com/
http://carpricegoods.com/
http://comradespoon.com/12h.hta
http://daferton.top/222g100/stis.php
http://documentseu.top/kdv/khxOqk77P1SsQQIgOJc07dm-FoL9L0eZKwyaYc3p/
http://emicthatmov.top/
http://explorblins.com/
http://fikasterwer.top/
http://firenicatrible.com/
http://gg.gg/in28937
http://greshman.xyz/
http://guguchrome.com
http://hdgravity.com/
http://hdtrenity.com/
http://morginakolim.com/
http://mosserdau.top/stis3.php
http://oceriesfornot.top/
http://rivertimad.com/
http://satisfyammyz.com/
http://vopulare.top/stis1.php
http://yankyhoni.com/
http://yourgroceries.top/
https://aleairyapps.com/n1wUIMSz/bg.png
https://app.any.run/tasks/8e0bb426-58fb-442c-bfe2-c0f54ce718ed/
https://bandariexpeditions.com/HrIWrCG7No/bg.png
https://bollydone.top/statn8923c3/d.php
https://bollydone.top/statn8923c3/s.php?b3ss4234j31f=f00j3ds3dssfsdf42c
https://collatera.top/statn8923c3/s.php?b3ss4234j31f=f00j3ds3dssfsdf42c
https://conderadio.tv/939025739.hta
https://conectta.net.br/support.php
https://cursilhosantarem.org/J6wLcLj5/010222.gif
https://efendri.net/zcj7VpA98P/bg.png
https://eminenttextiles.com/iBlpe8FPTcV/010222.gif
https://estudiopalmano.ar/aatpurritu/AO_3752005446.zip
https://estudiopalmano.ar/aatpurritu/oet-uciua-erpvrureaoptsaaemratiulttqo
https://geotrube.top/statn8923c3/d.php
https://modhub.com.br/upload.hta
https://osmcargo.com/pisteimietd/AO_2395782448.zip
https://osmcargo.com/pisteimietd/evucpirqiaieumsdsqpttsnoiiiilpeu-lna-aa
https://peat-sparkly-option.glitch.me/#user-google-drive-download
https://statmorte.top/stat8112.php
https://storage.googleapis.com/d4o1fmgw36oedr.appspot.com/0/file/sh/public/d/0/filedSdG2TzwEQtS.html?h=811377414896608351
https://storage.googleapis.com/df30kdhh3ivh3hd.appspot.com/0/files/k/public/d/038fdh3dj3fds3.html?h=289961809059013662
https://storage.googleapis.com/y8e4b6nv020vwz.appspot.com/d/files/sh/pub/s/0/fileWaJ79XY0wJhO.html?f=822667616455735753
https://storage.googleapis.com/zxvbsr00l2td00.appspot.com/1/files/s/pub/h/0/fileIhurxZMSLH16.html?h=800404757095175440
https://suabest.com/oHVGOzmnJ/010222.gif
https://tabgun.com/cuentademo.hta
https://test.baamyab.com/csnuiitntdidniibla/AO_3752005446.zip
https://test.baamyab.com/csnuiitntdidniibla/dea-din-esercseuceddpstftsearusmio
https://trading.expertonut.ro/ilqasmiimeeiumx/AO_3752005446.zip
https://trading.expertonut.ro/ilqasmiimeeiumx/saiuuulmrpseecruirn-oqoquelsaancnepertt-ixoe
https://www.imgenius.com.co/costarika.php

Emails

angelina.hernandez@milwoodhc.com
anne.origenes@milwoodhc.com
AnthonyChao@freshbooks.com
app@ybcsl.org
assistance@tampatravel.lol
atinker@mkeeyecare.com
billing@oiltrade.autos
bounces+eyhsgzgjdumutyff1m3kgw2@postman.samco.in
bounces+kcw9d3rjpjspjolnprkrba2@postman.samco.in
FrankLopez@zoho.com
guparphatua1981@tudordaysecondary.ac.ke
henriette33@nalandaemis.lk
informdental@soegateway.com
intake@hispanicumadaop.org
jmanaguelod@milwoodhc.com
kushal@jaytalent.com
mackenzie.gutkowski@gimt.ac.in
pouros.orpha@vulkanvegasissix.mfr-chile.com
rachelle.fernandez@milwoodhc.com
rocacike1987@tabgun.com
sale@homesale.lol
ScottDoucet@slack.com
subima@bronzevillerx.com
support@rrneonsb.beauty
ticket@boycottmarriott.com
uturcotte@alaadammaj.com
virginia.aspuria@milwoodhc.com

MD5

014012fc175dc0e5ac9687879543b1c2
074a57e17ed282cbf014e822a24cc6af
07ca8d4aaca9d5cd57796ee8abb54473
0887b662b85c73f0ef7d147d3f4ad12f
0cee796d8c39354f9a02fe0e31b21c49
0e3181ffe6c96b694379d09b0baa5c15
160d581ce7fee7b32cbe38f2a85c50a2
16ff002f41c10d9cb1ad893fb4142998
17204628a20a153b754164b0bcd8a19d
19ad56cad9778ccc69646cd7867df5ed
1b466072684d282f0fd4a8088e447d23
1c484ad055e8ec9c63d4a1bfc9820b15
1d976ca8f5a7c2d7da53b684202b19bb
1dc3389e3e90285d199d574456cdc8e7
1ef0f892e7a0eefe8e0c9edc4eba816d
1f6deef176d6e95b1fff1d40808f2a21
1ff4d7899d87b7762792bb84bc5f19d3
1ff65cdf503808c17f81fad7107688c7
2263deb7e5c8bf74440fb7b74a2cfe8b
27b175c9a777695f3bbba0a322353602
28ca7f6d873e31a9792cfc321d9c20a1
299c193f5b8a9d309bdd030bfbe7d147
2ac780fa4ac2cf6e12c32d542601b999
2bb68d98253ef61a8dd92b809a0a8bb1
3013ba8bca076369b4221410fde5cd21
349b0f23ca68596334f792a7d066fbe4
39bf5990eb83f073585b0ffcdb461edc
3a065b512e6aea3037e465ee6b9fd67d
3acbcd65f550ddd2c58540d04f35f902
3cf5b2a9f2ed871d5194c4e4a7da6070
3ed8244cf918cf3c644443746159c73f
409351ab35a1ee3c33722c477689d45b
4741f3c99e09e26f04c11cb07657355e
4796a812168d59c996ac24cf50e178ec
4873be19d84d123e95e9c52300f9f1a6
48c2cd1aae1f3a0c0b2f91cc3ba77632
491ff7e13fc3928f7e9947588ae2c65d
498bc31f26979282622fd31bc443380f
49dfa24dfad1973135b2c7c59c2fdfb5
4cdd9905bdece5d629f96ec8c96b26d4
4fc765e3ccf4b06a1b4f5bd0048d2a8a
51138beea3e2c21ec44d0932c71762a8
56bed1780bc4c4bca84acb42f770ea34
59be3a82b735f62ed179c574c25684f4
59edc587c641718124f5415f23d60995
5aadcce9933bdf764cae67f56136016a
5cfe084eb2a40ea3a57e46b4efddce35
5ead911d77fab57dbdc5518d8a5f2e0e
60bcd94d825fd734f18de08293a940ff
60fd1f36fdefea167a4665d95c048ffd
6145f864a9abb04b8a7280a085e92cc7
66f826f71c1bf48a2d03f3e057ee4b2d
678c044f8c7cb767fea3e963ba154266
68bedf5ad4524bfe48f4020ee283423a
6c286dd37bd3228a46ac4b8b12c737bb
6e08dc4b0f18268e0c31432cbc0961e8
6f9a717eeb140f05f35f8e581e4df1ac
6fa70d8b1cf269e0534f639140344aa6
702967d2205216c03078af01e0318f1e
70a3ef37e3ce8a7bd0b523f6bd8a4e37
71c8eb081c33fd6b2c10effa92154a18
73a2a00ca772abb82329d9c8a0390109
73a42eb2d1b8c54458e5e887f34d2273
73e6383af2bc5d4f003db03ee4e9caf2
7570e770b2061e5b0f23d19c1b123775
76ebb2b9df672bff15c7ced8b5318da1
777a20dc2f64eeb9195fb25113a3e7ac
77e1106d0ee3c074c5aa94663e62ca8c
7880ff2c1d4219a355720fb9bcccbcf9
7b8c1380fd0962a7d5402cd7b4a922a5
8097815c15794edea58b9e1f89ee6994
80ceb333eed34613781983edff303ad4
83f0f49d406fafff45b05011b75a026b
877e81688d32748a616473a8c53750a0
88629836bc228894bbc5263e5eb174b1
8964586e191990b49e8590f12bd3b091
9441c0354b8f4d484019621afb3036ad
95436fb67cb450fe375be29129bf900d
95c95194929e26dc098603031dc9b290
964be7b4246fc1b893c034ce2405c0fb
96e875546e38381c7a4a70b30034583a
99971c5e84c23a0afbe59d7b24f0c8f5
9a8b571cb91e693939df971a4c314ce3
9b1e8680c627340a654570cb00bb26fc
9b692f43d575acb739decfc809db7f2e
9edabe11d846a6de5d337e737d24e85c
a0819fe4cbbbaa4c3eef4c522f7f626f
a0d17b6072918299cead01ad59d7df67
a1804df75e39d56870e181d1ce951afb
a40c10cba1cf3cd0a77a3799551f7ef7
a4f2b04c18bb24be5011650708439631
a609fd3088ba7c9cbfde62c4331ccbea
a7a17a17a7993fc4dc1e836e706d2f5a
a7b85818eaa7fd00779fea172b89c40f
a7ec43a3bd10d95a788f79c20ab8796f
a9d0fb6d7544e366cc6eda4391fe2bcd
aac875d3f0ae686e1b0629077f6e90a1
ab953ffb4bd02b69ff98616e090ecdcf
ac37d72cd2dcfa9d844ec0f15ea404e7
ae97cd84c8d0e3fcdec330c063686470
aeb50d5c71fef23f46f4bdb6b20304bb
b4118a483b9d9d862ecb3a6f69135df6
b6c9c7c52150af9ab7ef7a153581c4f3
b8ce9a80a0a2321ba576191cfcf2aa53
ba7c084418c8ca484ee7c85d141eba41
bb1dd0af97236630037424de92394656
bbea89dce0db5a5dfbf645db5c3a615f
bd6554481e238361519304999f6462c6
c04572dfa7eb19ba7475f84d1e9f6911
c1aa08827664ab82446e955b284db649
c754f3d9cdca9c58f7b9d0a486e4d388
c7d4bf7b33d2bb91b7e0f1f4844c2703
c87d36f4d57acdee049c6719f42af933
ca185fe12ff54699538212530095b63b
ca726dcd01714eb54a5360f46228a6e1
ca9b880a885ab1e5ff0ab8829343b83f
cbeb0204706e0cc62439ae8667084772
cc520095ed8a7a5406bc2fa85b7706b4
cf0d7d7888e6598d3f0c7e7ae4ea44c5
d04770310cbe1474825a1ab125e21488
d06efb0ed703d32a6389be17d01a0010
d1defc05bd9b09df7d881859d8d91b8a
d4090dc1881164fce7ca78fc9583dc02
d4469032dd2fa795e7eeb995a3b7f1f1
d517e637e479e22e61d44c3f39f196f3
d63e49c3bc70fe22bbb61c2a17cf284b
d6755e7eb65da42dad2b5de4b97f8bb2
d7b2aee28e56b74e942d24ef223284cb
d7e2170af2d0d72c4f0f99abc7d2bc5a
d8f8d89a1c832f262cbfaeeb9a0dbee0
d940f57ff05d71eb52b1c1ab693edcf1
db92ce8ac764bfc5891dc93ed0237b18
ddbd04ad22c652f6ce2a8c27480223d1
df0427ffce0ed1966d0d39c7d5aa7753
e2b1072300f34e5e87ce159a2ce5fd39
e2ec1ce7f9310e8a545ccb23c6e021a9
e61b8051e565e79fa7a5bf3736e66033
e743c4bf91655b22d8f8c2893b9c9ece
eaf0a60f701693797cd36adf787f9520
ee43914636f5e90c54e7fa5f2b011fda
f017c8c3f5b61e382b7fd24b70a40389
f273be61339605eddf6b33b07e5c5d94
f3055ab3f84b95917689126b3600cd96
f4c07f66228f75c722333e85c70e7b0a
f58ac01d435dbed83ed1b00e33d847dc
f75272081bf82d871060135e84e8de01
f8927c8040386cb895fb55208bb52c84
f8cf9c665d2b09f0cc372a63d91cd682
f941d1fab8e1088ba73f9f94c48da67c
fd427829c7308d944a5a5abfa065ce55
fdb8b6148d2d8888ab7e504a1c6affd0
ff0be0be23ac9298e959035909d276f1
ff7e3a59ce5407f8db004a9df9e212b1