General

  • Target

    4446508bff628b75d9923a6d4cb0d55c_JaffaCakes118

  • Size

    267KB

  • Sample

    240729-nvb69s1dmb

  • MD5

    4446508bff628b75d9923a6d4cb0d55c

  • SHA1

    1521e01d1e76db8213214f88ab59313e185f117e

  • SHA256

    50627d0516944503312951774b8b7586f9409f312b7742347697996c10ead658

  • SHA512

    9ed64c0911def17e811b8ad2e9c64c86ce5681612b13c0601c80af3a95a53a6e913a7d8929ef44a75908f5b456735d9d61fe54a649b48ddd71c5bcc5ce196881

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVy5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoClvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      4446508bff628b75d9923a6d4cb0d55c_JaffaCakes118

    • Size

      267KB

    • MD5

      4446508bff628b75d9923a6d4cb0d55c

    • SHA1

      1521e01d1e76db8213214f88ab59313e185f117e

    • SHA256

      50627d0516944503312951774b8b7586f9409f312b7742347697996c10ead658

    • SHA512

      9ed64c0911def17e811b8ad2e9c64c86ce5681612b13c0601c80af3a95a53a6e913a7d8929ef44a75908f5b456735d9d61fe54a649b48ddd71c5bcc5ce196881

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVy5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoClvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks