General

  • Target

    00df497293a48b38b4776e560ae1f412_JaffaCakes118

  • Size

    267KB

  • Sample

    240727-zpmllaybjk

  • MD5

    00df497293a48b38b4776e560ae1f412

  • SHA1

    9680236c5a8a699f43ed2947d042504582e8097c

  • SHA256

    0de87bcd83237b564ed508b574d0195c7c51220571c22b44f0f188af1369e558

  • SHA512

    b6fe1159db1556efdee40e1fbf5e2fd65e192645cc292e3cfb95a6351c2bc3319cc67ab9574917a47c467d24932d77fb76c14c2ebcbd53094955d8eccfa3e9b2

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCCvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      00df497293a48b38b4776e560ae1f412_JaffaCakes118

    • Size

      267KB

    • MD5

      00df497293a48b38b4776e560ae1f412

    • SHA1

      9680236c5a8a699f43ed2947d042504582e8097c

    • SHA256

      0de87bcd83237b564ed508b574d0195c7c51220571c22b44f0f188af1369e558

    • SHA512

      b6fe1159db1556efdee40e1fbf5e2fd65e192645cc292e3cfb95a6351c2bc3319cc67ab9574917a47c467d24932d77fb76c14c2ebcbd53094955d8eccfa3e9b2

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCCvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks