General

  • Target

    4baca960d6cca5680e99bcedd1d7972d_JaffaCakes118

  • Size

    282KB

  • Sample

    240729-rpexrawfnd

  • MD5

    4baca960d6cca5680e99bcedd1d7972d

  • SHA1

    70cbfd0b02a0a5689c88fa4d3a9b24627506d562

  • SHA256

    78e9ecbe1ad43a3e55286c52bebc0fd3fd51fca0ec8f48caceef60b612ecb4b6

  • SHA512

    454fc9d2825d6626d02f9e0f6a1ae041294d0bfc19f8d2645e3202ef37d11fa28b7406ebc591d9a2e3bba6a94f7c020f8415885285aefed0de70acfc5c53c7cd

  • SSDEEP

    3072:XklIl0fRKmQALz+jQavn5hM3k5+LwdT0V6X7vHrSA54mNY7S7p0ngeAg0Fujow3G:Umlc4pVPvP+L9V2/r8AOR3dLk0RO

Malware Config

Extracted

Family

icedid

C2

astedolo.asia

Targets

    • Target

      4baca960d6cca5680e99bcedd1d7972d_JaffaCakes118

    • Size

      282KB

    • MD5

      4baca960d6cca5680e99bcedd1d7972d

    • SHA1

      70cbfd0b02a0a5689c88fa4d3a9b24627506d562

    • SHA256

      78e9ecbe1ad43a3e55286c52bebc0fd3fd51fca0ec8f48caceef60b612ecb4b6

    • SHA512

      454fc9d2825d6626d02f9e0f6a1ae041294d0bfc19f8d2645e3202ef37d11fa28b7406ebc591d9a2e3bba6a94f7c020f8415885285aefed0de70acfc5c53c7cd

    • SSDEEP

      3072:XklIl0fRKmQALz+jQavn5hM3k5+LwdT0V6X7vHrSA54mNY7S7p0ngeAg0Fujow3G:Umlc4pVPvP+L9V2/r8AOR3dLk0RO

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks