Resubmissions

26-12-2022 18:03

221226-wnchfsge5w 3

26-12-2022 12:51

221226-p3jrragb4y 10

General

  • Target

    Request_12-23#183.iso

  • Size

    2.1MB

  • Sample

    221226-p3jrragb4y

  • MD5

    2f39a11049419baf7305d6abf0d45dfc

  • SHA1

    2c9b2484039b387aac6f1c6fbe3c6ab05e728edd

  • SHA256

    f3a9b733cb33c4d257589e70c8d9cf4b5136cb3932bce2ea1b31bc9d5b06a5ae

  • SHA512

    e1f42636f1f4684672d1f2ea6b01cb073dd8c51ba28b8fabff5394f921bc73b1b4bdd942a329a2d32b16254a8b8a47940e2409986a992cce7dc0e6015fe13eb8

  • SSDEEP

    12288:4/pNfmaYOTAl0PFX783QgZGXNfnD4SpZi+wwLMfEWm+CJthm:4/zf8j0FXY3Q5XN7pY+wwxZjJthm

Malware Config

Extracted

Family

icedid

Campaign

3146401099

C2

trbiriumpa.com

Targets

    • Target

      Request_12-23#183.iso

    • Size

      2.1MB

    • MD5

      2f39a11049419baf7305d6abf0d45dfc

    • SHA1

      2c9b2484039b387aac6f1c6fbe3c6ab05e728edd

    • SHA256

      f3a9b733cb33c4d257589e70c8d9cf4b5136cb3932bce2ea1b31bc9d5b06a5ae

    • SHA512

      e1f42636f1f4684672d1f2ea6b01cb073dd8c51ba28b8fabff5394f921bc73b1b4bdd942a329a2d32b16254a8b8a47940e2409986a992cce7dc0e6015fe13eb8

    • SSDEEP

      12288:4/pNfmaYOTAl0PFX783QgZGXNfnD4SpZi+wwLMfEWm+CJthm:4/zf8j0FXY3Q5XN7pY+wwxZjJthm

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v6

Tasks