General

  • Target

    99f900d6050311138fde067981255976_JaffaCakes118

  • Size

    282KB

  • Sample

    240815-n1w4mavdnq

  • MD5

    99f900d6050311138fde067981255976

  • SHA1

    2fb69cd16f43c981e1fd4d265928d4bf518ae7d2

  • SHA256

    5c06b00830e828ac09b88c7afcd94dc5a28b238333400d51af06fda58d99b81d

  • SHA512

    79c11ffb7bb9aa87fcebccf8c0a6769d570b0b39b8788f747306b0c91b83d5e7586715efe939b0563a56dddadf5c37438cde6b7165fcbe8085af49c915ea9fa0

  • SSDEEP

    3072:XklIl0fRKmQuLz+jQavn5hM3k5+LwdT0V6X7vHrSA54mNY7S7p0ngeAg0Fujow3G:Umlc4/VPvP+L9V2/r8AOR3dLk0RO

Malware Config

Extracted

Family

icedid

C2

astedolo.asia

Targets

    • Target

      99f900d6050311138fde067981255976_JaffaCakes118

    • Size

      282KB

    • MD5

      99f900d6050311138fde067981255976

    • SHA1

      2fb69cd16f43c981e1fd4d265928d4bf518ae7d2

    • SHA256

      5c06b00830e828ac09b88c7afcd94dc5a28b238333400d51af06fda58d99b81d

    • SHA512

      79c11ffb7bb9aa87fcebccf8c0a6769d570b0b39b8788f747306b0c91b83d5e7586715efe939b0563a56dddadf5c37438cde6b7165fcbe8085af49c915ea9fa0

    • SSDEEP

      3072:XklIl0fRKmQuLz+jQavn5hM3k5+LwdT0V6X7vHrSA54mNY7S7p0ngeAg0Fujow3G:Umlc4/VPvP+L9V2/r8AOR3dLk0RO

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks