General

  • Target

    655f99cffbc04764c1d3aeff8b9ec147_JaffaCakes118

  • Size

    267KB

  • Sample

    240729-2sm3msvbnj

  • MD5

    655f99cffbc04764c1d3aeff8b9ec147

  • SHA1

    2b5b6fc137fdb88bed7a5c76a9801cc51b6a7257

  • SHA256

    43f6440819114c71e2312a956672c8b2a4aa82e4c9ca230c3cf6b456b5b46d51

  • SHA512

    8a40c1e3af2002e4f71049b342ac5021a3041c67fbe5c91d69357b0ff193da2d24365b4337183c3cb32176137b1ec3b3a63c4d9d3c06eb1acc29875eefdd0f5d

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVI5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC/vytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      655f99cffbc04764c1d3aeff8b9ec147_JaffaCakes118

    • Size

      267KB

    • MD5

      655f99cffbc04764c1d3aeff8b9ec147

    • SHA1

      2b5b6fc137fdb88bed7a5c76a9801cc51b6a7257

    • SHA256

      43f6440819114c71e2312a956672c8b2a4aa82e4c9ca230c3cf6b456b5b46d51

    • SHA512

      8a40c1e3af2002e4f71049b342ac5021a3041c67fbe5c91d69357b0ff193da2d24365b4337183c3cb32176137b1ec3b3a63c4d9d3c06eb1acc29875eefdd0f5d

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVI5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC/vytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks