{"schema":"aeternae-malware-metadata/v1","generated_at":"2026-10-08T08:38:25+00:00","total_matching":1,"page":1,"page_size":200,"records":[{"id":"2c42d8756858a60e42069777c6191b984355152c30ba74b8e20a20623249628a","kind":"reference","title":"IcedID","family":"IcedID","category":"Malware intelligence","summary":"Malware galaxy based on Malpedia archive. | Analysis Observations: * It sets up persistence by creating a Scheduled Task with the following characteristics: * Name: Update * Trigger: At Log on * Action: %LocalAppData%\\$Example\\\\waroupada.exe /i * Conditions: Stop if the computer ceases to be idle. * The sub-directory within %LocalAppdata%, Appears to be randomly picked from the list of directories","first_seen":1753977261,"last_seen":1753977261,"created_at":1791440203,"updated_at":1791440203,"source_count":1,"data":{"context":"2025/07/using-llms-as-a-reverse-engineering-sidekick.json","tags":["misp:galaxy-name=\"Malpedia\"","misp:galaxy-type=\"malpedia\"","misp-galaxy:malpedia=\"IcedID\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2025/07/using-llms-as-a-reverse-engineering-sidekick.json"],"filenames":[],"features":[],"related_cves":[],"labels":["IcedID"]},"observations":[{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2025/07/using-llms-as-a-reverse-engineering-sidekick.json","source_label":"IcedID","evidence_class":"provider_reported","confidence":null,"observed_at":1753977261,"fetched_at":1791440203,"data":{"context":"2025/07/using-llms-as-a-reverse-engineering-sidekick.json","tags":["misp:galaxy-name=\"Malpedia\"","misp:galaxy-type=\"malpedia\"","misp-galaxy:malpedia=\"IcedID\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2025/07/using-llms-as-a-reverse-engineering-sidekick.json"],"family":"IcedID"}}],"indicators":[]}]}