General

  • Target

    06a75fa8f742c741a83653a370790cc3_JaffaCakes118

  • Size

    267KB

  • Sample

    240728-dlp2naxhlg

  • MD5

    06a75fa8f742c741a83653a370790cc3

  • SHA1

    d0ede835d66d70869415ee1c3d2bac7043deb697

  • SHA256

    ed7b8d4af7983c4517a6b582a3b385056db8d0a7d9c46194947a5ebaead2b1ac

  • SHA512

    c2d44bad19fcefaa205169d26af9a20108c0867b4c1966b31e3e8b7673683b1b3c0e23e6663a62ffccb21b0f713adbc51070e4b8c010920ba8d11f4ee50ef41b

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC2vytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      06a75fa8f742c741a83653a370790cc3_JaffaCakes118

    • Size

      267KB

    • MD5

      06a75fa8f742c741a83653a370790cc3

    • SHA1

      d0ede835d66d70869415ee1c3d2bac7043deb697

    • SHA256

      ed7b8d4af7983c4517a6b582a3b385056db8d0a7d9c46194947a5ebaead2b1ac

    • SHA512

      c2d44bad19fcefaa205169d26af9a20108c0867b4c1966b31e3e8b7673683b1b3c0e23e6663a62ffccb21b0f713adbc51070e4b8c010920ba8d11f4ee50ef41b

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC2vytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks