General

  • Target

    11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118

  • Size

    267KB

  • Sample

    240728-kzmxsaycqp

  • MD5

    11a178d30b84e7afa0a759d6048c48e1

  • SHA1

    6c612f49d04675229f56e7021ac18cdeba37e6d0

  • SHA256

    f591e473859ad8efcc6390732aca39899fe5910101618bfcff8b4c062c3c5fe0

  • SHA512

    58f4a9bf209d7505c8aba1e02577ec34dc2640cd6f7eea4b0f97515c75bab332a40eef30db0751f68ab4846b1fc44b855330609ce9fdf2ee0a37b110ec2b2e1d

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVT5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCevytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118

    • Size

      267KB

    • MD5

      11a178d30b84e7afa0a759d6048c48e1

    • SHA1

      6c612f49d04675229f56e7021ac18cdeba37e6d0

    • SHA256

      f591e473859ad8efcc6390732aca39899fe5910101618bfcff8b4c062c3c5fe0

    • SHA512

      58f4a9bf209d7505c8aba1e02577ec34dc2640cd6f7eea4b0f97515c75bab332a40eef30db0751f68ab4846b1fc44b855330609ce9fdf2ee0a37b110ec2b2e1d

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVT5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCevytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks