General

  • Target

    08611f014ec85553012e359dda9d8014_JaffaCakes118

  • Size

    267KB

  • Sample

    240728-eljejszgrf

  • MD5

    08611f014ec85553012e359dda9d8014

  • SHA1

    58da861aaef777ae6b0cb7d4e316b9b7cd0539b1

  • SHA256

    a84da88d30017633824c0731d6637a80c1fe97c40f9d6421b39c94b367b35a2f

  • SHA512

    a5555a93599e62f98ab5c28590f8b2721afd85a5870ef9f5471450d4b6944a54703e767904e8ab36c6f82757cdf3058eb3298b0ebbfec9f29b215b79de03a092

  • SSDEEP

    3072:WKCvsQ1ZkyvvaV05wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCDvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      08611f014ec85553012e359dda9d8014_JaffaCakes118

    • Size

      267KB

    • MD5

      08611f014ec85553012e359dda9d8014

    • SHA1

      58da861aaef777ae6b0cb7d4e316b9b7cd0539b1

    • SHA256

      a84da88d30017633824c0731d6637a80c1fe97c40f9d6421b39c94b367b35a2f

    • SHA512

      a5555a93599e62f98ab5c28590f8b2721afd85a5870ef9f5471450d4b6944a54703e767904e8ab36c6f82757cdf3058eb3298b0ebbfec9f29b215b79de03a092

    • SSDEEP

      3072:WKCvsQ1ZkyvvaV05wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCDvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks