General

  • Target

    awake32.tmp.zip

  • Size

    460KB

  • Sample

    230413-vlswzsch66

  • MD5

    66931f0e96d43ec5437aba91a79508f3

  • SHA1

    f7f290c21424c976ff0eeb56c3ce0e6ac75941aa

  • SHA256

    204ae820a286ea0b75063163c29e21ad34084b7d86510a7db0b2c5e67fb333cb

  • SHA512

    065059d51e081209f253bafdddb6b865a1fd1ea104c648e61041ded5604a172269e00313aa2d1405a6d131a0942325dc7c1f34f4b9c0c3f88536d74c8c5a789a

  • SSDEEP

    12288:WYxtJ95OlZg8gHHoWqYq4J4nSVL29Mh6TSh:WIIP4HoWzJ4n89kO

Malware Config

Extracted

Family

icedid

Botnet

2646410796

C2

abigelofraj.com

yhorneedminf.com

Attributes
  • auth_var

    16

  • url_path

    /news/

Targets

    • Target

      awake32.tmp

    • Size

      235KB

    • MD5

      586069431de993344e781ece9607b24e

    • SHA1

      27fee626b02b60862e8a1d8ea93a681c92bd385a

    • SHA256

      02de2d5cafef10c90d0dca658524c9a36b09cb6bd9482373f0e644393faea5da

    • SHA512

      068b18bc7651ca23a87e585a5aa2029115fa3f9abc04d89c62cacb5f404866ac79d8823e53e1b5c56cd4dd88b03c0bca56a961a359fd872ab420223ed05f117a

    • SSDEEP

      6144:jtjTQl3Tn4zZZDRuptdPTcfm8cpOuJC8DRv/ni/s5Xg:jtjkWzZZQptdPTKccucD

    Score
    3/10
    • Target

      run.bat

    • Size

      52B

    • MD5

      0d05c5d81313dc589b57df12401e6688

    • SHA1

      44f72793d2490dc34e728450df342cbe4cbebd74

    • SHA256

      45ea9ebc1d93a95f935a90c0d113bd85fbe7db040aaa6692b22594a669c6b973

    • SHA512

      56e9e9e52f1db72f32bd5079500e3af3b04662c8a0e0b2e9d2b93023d260eeaab42512f7ecd76a4e8a9a318fd07471ccbbc241fb8777a98472da9ad238554a6c

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

MITRE ATT&CK Matrix

Tasks