General

  • Target

    9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118

  • Size

    269KB

  • Sample

    240815-plcxwa1ela

  • MD5

    9a0b04c75d3f64bcd7c59632555f401d

  • SHA1

    fe0731f820b46258100c37f49b412be39c976776

  • SHA256

    e2d3e9a7819a89cffc3f614f62d44a8312eccea750e9fb0adac154ff5ea0f5f7

  • SHA512

    51233be939dd3fb3df6b8700e79fdc2739e3f63c73ab3bc60450c4e593a1174c3a647608209d2d472e098a8daa94049aa9e6d62d6cebcf8ce3b26247fd938c8e

  • SSDEEP

    6144:8JKIHlPW3P3ose/2t4zolRPKMAO13+OnUzhXVx:uKOlyoi4zYRnj3rKVx

Malware Config

Extracted

Family

icedid

C2

vragafraga.beer

Targets

    • Target

      9a0b04c75d3f64bcd7c59632555f401d_JaffaCakes118

    • Size

      269KB

    • MD5

      9a0b04c75d3f64bcd7c59632555f401d

    • SHA1

      fe0731f820b46258100c37f49b412be39c976776

    • SHA256

      e2d3e9a7819a89cffc3f614f62d44a8312eccea750e9fb0adac154ff5ea0f5f7

    • SHA512

      51233be939dd3fb3df6b8700e79fdc2739e3f63c73ab3bc60450c4e593a1174c3a647608209d2d472e098a8daa94049aa9e6d62d6cebcf8ce3b26247fd938c8e

    • SSDEEP

      6144:8JKIHlPW3P3ose/2t4zolRPKMAO13+OnUzhXVx:uKOlyoi4zYRnj3rKVx

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks