mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
name: IcedID
|
|
id: 1d2cc747-63d7-49a9-abb8-93aa36305603
|
|
version: 1
|
|
date: '2021-07-29'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
description: Leverage searches that allow you to detect and investigate unusual activities
|
|
that might relate to the IcedID banking trojan, including looking for file writes
|
|
associated with its payload, process injection, shellcode execution and data collection.
|
|
narrative: IcedId banking trojan campaigns targeting banks and other vertical sectors.This
|
|
malware is known in Microsoft Windows OS targetting browser such as firefox and
|
|
chrom to steal banking information. It is also known to its unique payload downloaded
|
|
in C2 where it can be a .png file that hides the core shellcode bot using steganography
|
|
technique or gzip dat file that contains "license.dat" which is the actual core
|
|
icedid bot.
|
|
references:
|
|
- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
|
|
- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
|
|
tags:
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|