General

  • Target

    a4d8fc01e5ef219914e7de710281a6a5_JaffaCakes118

  • Size

    267KB

  • Sample

    240818-bs5dtaxfmh

  • MD5

    a4d8fc01e5ef219914e7de710281a6a5

  • SHA1

    252a638d94607ca390d6c5d6a0126294834e3961

  • SHA256

    7ff6e0e68e741fe2050a7cfaee0f790a6b0544105d5bdd4ea5ba0646835036da

  • SHA512

    c255f9703daf37295862db3a236c4ccc6ce12ee70133f6f082cbc00aa158ca11b30d2af3abf4fedb18e18b94132ee5ff250f789d8d263c450b69a329cdaae523

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVt5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCovytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      a4d8fc01e5ef219914e7de710281a6a5_JaffaCakes118

    • Size

      267KB

    • MD5

      a4d8fc01e5ef219914e7de710281a6a5

    • SHA1

      252a638d94607ca390d6c5d6a0126294834e3961

    • SHA256

      7ff6e0e68e741fe2050a7cfaee0f790a6b0544105d5bdd4ea5ba0646835036da

    • SHA512

      c255f9703daf37295862db3a236c4ccc6ce12ee70133f6f082cbc00aa158ca11b30d2af3abf4fedb18e18b94132ee5ff250f789d8d263c450b69a329cdaae523

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVt5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCovytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks