General

  • Target

    6597e14cac2e2cc5c7450c77553fed6b_JaffaCakes118

  • Size

    267KB

  • Sample

    240729-2wlzravcql

  • MD5

    6597e14cac2e2cc5c7450c77553fed6b

  • SHA1

    e0ab3a1f476bf4104de300b5687fb2e9c15c3c5d

  • SHA256

    e8b24d7c8dd0898bf688705afa305bab577fbd5a83bd260f2d07ed29bbc80dff

  • SHA512

    4191b3f2e6cf8d4bf9bb134fffc4e00069c18ed524189774dc237fad53c51d02a91b5c988cf6230abbefcfbfbdd60ff602e95a02d95adaa20809d499530c5f5d

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVr5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0Fujc:LQrkoCGvytr7UtkiBvPLiAOg3kaeXV6

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      6597e14cac2e2cc5c7450c77553fed6b_JaffaCakes118

    • Size

      267KB

    • MD5

      6597e14cac2e2cc5c7450c77553fed6b

    • SHA1

      e0ab3a1f476bf4104de300b5687fb2e9c15c3c5d

    • SHA256

      e8b24d7c8dd0898bf688705afa305bab577fbd5a83bd260f2d07ed29bbc80dff

    • SHA512

      4191b3f2e6cf8d4bf9bb134fffc4e00069c18ed524189774dc237fad53c51d02a91b5c988cf6230abbefcfbfbdd60ff602e95a02d95adaa20809d499530c5f5d

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVr5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0Fujc:LQrkoCGvytr7UtkiBvPLiAOg3kaeXV6

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks