General

  • Target

    44c311010aa930d0772843d4cba5581a_JaffaCakes118

  • Size

    267KB

  • Sample

    240729-n1bgxs1fjd

  • MD5

    44c311010aa930d0772843d4cba5581a

  • SHA1

    4ece84bc3a57e7ab3959cea9f3586d7588c6fac3

  • SHA256

    13c850f0419cd63e6eda74d134d468edf9f2d9d13cbbc655fbd36e89c6b1e46f

  • SHA512

    54af01b96eff501acb0fe6dc45782d46713a5dafdee02628f9a2cf7f0c26fc5ccf322c8a6417eaf9cfa97024e32ca82f7e08df6f37252b8015aeeceb4ca2b180

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVP5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCKvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      44c311010aa930d0772843d4cba5581a_JaffaCakes118

    • Size

      267KB

    • MD5

      44c311010aa930d0772843d4cba5581a

    • SHA1

      4ece84bc3a57e7ab3959cea9f3586d7588c6fac3

    • SHA256

      13c850f0419cd63e6eda74d134d468edf9f2d9d13cbbc655fbd36e89c6b1e46f

    • SHA512

      54af01b96eff501acb0fe6dc45782d46713a5dafdee02628f9a2cf7f0c26fc5ccf322c8a6417eaf9cfa97024e32ca82f7e08df6f37252b8015aeeceb4ca2b180

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVP5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCKvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks