General

  • Target

    761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46

  • Size

    1.5MB

  • Sample

    220701-d1wgzsabfk

  • MD5

    a44128ac144b7b03b9a18a1b3b81a3ab

  • SHA1

    9d2afb0890ece493ddd68cd372d02d0e4b2edd70

  • SHA256

    761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46

  • SHA512

    6d6b18856ddc7aa192528e7621cf5c4e2b817885b2c1c973428ed6ef73c66d5c81d94acf24b96765189d3e10badcdb44c9a4d52838344c114a56001ea0eafcaf

Malware Config

Extracted

Family

icedid

Botnet

2794990697

C2

sheaffic.org

memphase.com

vulcate.com

sheaffic.com

eurobable.com

Attributes
  • auth_var

    1

  • url_path

    /index.php

Extracted

Family

icedid

Targets

    • Target

      761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46

    • Size

      1.5MB

    • MD5

      a44128ac144b7b03b9a18a1b3b81a3ab

    • SHA1

      9d2afb0890ece493ddd68cd372d02d0e4b2edd70

    • SHA256

      761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46

    • SHA512

      6d6b18856ddc7aa192528e7621cf5c4e2b817885b2c1c973428ed6ef73c66d5c81d94acf24b96765189d3e10badcdb44c9a4d52838344c114a56001ea0eafcaf

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • IcedID Second Stage Loader

MITRE ATT&CK Matrix

Tasks