General

  • Target

    3f9cf3795f03024fc601e7d30f42b599_JaffaCakes118

  • Size

    267KB

  • Sample

    240729-l378kasdlj

  • MD5

    3f9cf3795f03024fc601e7d30f42b599

  • SHA1

    f951a7b1e08305f560f00528d8e0bf160110d34f

  • SHA256

    756f91d003c22eec8e478f20b124fef3c8e18fd550df645c0148a6ddd91a973d

  • SHA512

    c57a402a037c36e84aaae4e722eea4cf9bc7e190cdadb95a503f83c27b53f5fbf54c51909e1de2adbec9fe3e14c86f22088f18053ce280873b4b2e80a0e775fb

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCmvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      3f9cf3795f03024fc601e7d30f42b599_JaffaCakes118

    • Size

      267KB

    • MD5

      3f9cf3795f03024fc601e7d30f42b599

    • SHA1

      f951a7b1e08305f560f00528d8e0bf160110d34f

    • SHA256

      756f91d003c22eec8e478f20b124fef3c8e18fd550df645c0148a6ddd91a973d

    • SHA512

      c57a402a037c36e84aaae4e722eea4cf9bc7e190cdadb95a503f83c27b53f5fbf54c51909e1de2adbec9fe3e14c86f22088f18053ce280873b4b2e80a0e775fb

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVD5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCmvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks