General

  • Target

    92a017789e4750f002668d6132bb22e4_JaffaCakes118

  • Size

    267KB

  • Sample

    240813-l6l5haxeka

  • MD5

    92a017789e4750f002668d6132bb22e4

  • SHA1

    087df5939e6337e1cb0dd144a42f48531af05904

  • SHA256

    ea2d23a8c4bc9ad4c34b8a20823f8b4db812fb1a7ed96b2cd4a7d67daa2bf2fa

  • SHA512

    d7f43245de807258d7b48b40e449d4a1c7eb297ac7d66a31a198028afec9d8c3b972600e94bf4089e43c214cf3032f9b58b599e1a0cffff7bdc8857b3b43dd2e

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVP5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC+vytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      92a017789e4750f002668d6132bb22e4_JaffaCakes118

    • Size

      267KB

    • MD5

      92a017789e4750f002668d6132bb22e4

    • SHA1

      087df5939e6337e1cb0dd144a42f48531af05904

    • SHA256

      ea2d23a8c4bc9ad4c34b8a20823f8b4db812fb1a7ed96b2cd4a7d67daa2bf2fa

    • SHA512

      d7f43245de807258d7b48b40e449d4a1c7eb297ac7d66a31a198028afec9d8c3b972600e94bf4089e43c214cf3032f9b58b599e1a0cffff7bdc8857b3b43dd2e

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVP5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC+vytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks