2021-05-27 IcedID IOCs

THREAT IDENTIFICATION:  ICEDID

SENDERS OBSERVED
lynnpix841@gmail.com

FORM CONTENTS
Hi!

My name is Melody.

Your website or a website that your company hosts is infringing on a copyright protected images owned by myself.

Take a look at this report with the hyperlinks to my images you used at www.<yourdomain>.com and my previous publications to get the proof of my copyrights.

Download it now and check this out for yourself:

https://sites.google.com/view/234387234572004834/d/download/0/shared/files?fileID=140612158322889214

I believe you've deliberately violated my rights under 17 U.S.C. Section 101 et seq. and could be liable for statutory damages as high as $130,000 as set-forth in Sec. 504(c)(2) of the Digital millennium copyright act (”DMCA”) therein.

This message is official notice. I demand the elimination of the infringing materials described above. Please be aware as a service provider, the Digital Millennium Copyright Act demands you, to remove and terminate access to the copyrighted materials upon receipt of this notification letter. In case you do not stop the utilization of the aforementioned copyrighted content a legal action can be initiated against you.

I have a strong faith belief that use of the copyrighted materials referenced above as presumably violating is not permitted by the copyright owner, its legal agent, as well as laws.

I swear, under consequence of perjury, that the information in this letter is accurate and that I am the legal copyright owner or am certified to act on behalf of the proprietor of an exclusive right that is allegedly infringed.

Regards,
Melody Lynn

05/27/2021

MALDOC DOWNLOAD URL
https://sites.google.com/view/234387234572004834/d/download/0/shared/files?fileID=140612158322889214

MALDOC FILE HASHES
Stolen Images Evidence.zip
ddfc4e91a1750dc184dad19cab97c3fe

Stolen Images Evidence.js
8a7efa40b42b6de785f13dcd505a0b1a

PAYLOAD DOWNLOAD URLS
http://bediloper.top/034g100/index.php
http://bediloper.top/034g100/main.php

main.php
a8737302ebec172bbf8f1dfe30a81b64

RYDTKuh.dat
8dabd9a48c5b96cc629d72cc9b0c0d0d

They're both 64-bit .dll files

ICEDID C2s
http://lascakatheather.top/
172.67.198.112

SUPPORTING EVIDENCE
https://www.microsoft.com/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/