General

  • Target

    ce9b8b9019a185c1c346334bd9e70939_JaffaCakes118

  • Size

    267KB

  • Sample

    240906-emnqnawarg

  • MD5

    ce9b8b9019a185c1c346334bd9e70939

  • SHA1

    bac6905c18d7ab7aef2e340c7384fa41cdbebb9c

  • SHA256

    850970e2dfb4f52b461b6daf8bed02469a391ec1d4c1d9251ab427e06a282225

  • SHA512

    f870f0cdbaea32e14d5f30b43025f719a611ef1d1ba246e4cd7db82646d137c58c351dcfdc7a665b0fa747c9628d085ff1cfe0a692cc5779d9b0a4c265fecebd

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVG5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCRvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      ce9b8b9019a185c1c346334bd9e70939_JaffaCakes118

    • Size

      267KB

    • MD5

      ce9b8b9019a185c1c346334bd9e70939

    • SHA1

      bac6905c18d7ab7aef2e340c7384fa41cdbebb9c

    • SHA256

      850970e2dfb4f52b461b6daf8bed02469a391ec1d4c1d9251ab427e06a282225

    • SHA512

      f870f0cdbaea32e14d5f30b43025f719a611ef1d1ba246e4cd7db82646d137c58c351dcfdc7a665b0fa747c9628d085ff1cfe0a692cc5779d9b0a4c265fecebd

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVG5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCRvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks