Resubmissions

28-04-2023 10:36

230428-mnj3vsfd2s 10

28-03-2023 11:33

230328-nnvd9saf88 10

General

  • Target

    jug.dll.exe

  • Size

    317KB

  • Sample

    230328-nnvd9saf88

  • MD5

    c0d45a442b3f1ef9d795e7b83c8fff4a

  • SHA1

    b5f3bc186cac696e0664c32c1f4036414f1d5538

  • SHA256

    30f7e6a787e359b165a870828621b7c75e39cd2452abe8c707afb28e0b50870d

  • SHA512

    2a38fa803ad575028e715bcb7b4fc02f8009aa5bee22b3466df23e084ae8c304d717735f2aa0ccaf41ad9522f62909c0c92778b8e784ae55032b7ec468affcae

  • SSDEEP

    6144:hiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFT:hiaxP58X2ikP7U1A1

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Targets

    • Target

      jug.dll.exe

    • Size

      317KB

    • MD5

      c0d45a442b3f1ef9d795e7b83c8fff4a

    • SHA1

      b5f3bc186cac696e0664c32c1f4036414f1d5538

    • SHA256

      30f7e6a787e359b165a870828621b7c75e39cd2452abe8c707afb28e0b50870d

    • SHA512

      2a38fa803ad575028e715bcb7b4fc02f8009aa5bee22b3466df23e084ae8c304d717735f2aa0ccaf41ad9522f62909c0c92778b8e784ae55032b7ec468affcae

    • SSDEEP

      6144:hiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFT:hiaxP58X2ikP7U1A1

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks