General

  • Target

    d5bb2f1c460f904fe6c6c2fed6ce21a5_JaffaCakes118

  • Size

    214KB

  • Sample

    240909-gbqf8awgkh

  • MD5

    d5bb2f1c460f904fe6c6c2fed6ce21a5

  • SHA1

    4f6d054ed86c41b334af49a3bfaf42120fd2876c

  • SHA256

    30ac7415f1cdd5984cdfe15961eb46211c444786c453cfe8525dacd7c76c28b6

  • SHA512

    8b3726cbe99b7b05d155858f43b7c6010ecd71be42ffdb64f2e8da4de281fc3786494c66883567d26a82f3a33d543f495f328db58055ce88a82a769d627c1a10

  • SSDEEP

    6144:54+U6OuzhTIXJnxeecA9ikbl4yB6ETGzM0yT:a+U6O6eh9cA/lV6ETGw0yT

Malware Config

Extracted

Family

icedid

C2

ldrshekel.casa

Targets

    • Target

      d5bb2f1c460f904fe6c6c2fed6ce21a5_JaffaCakes118

    • Size

      214KB

    • MD5

      d5bb2f1c460f904fe6c6c2fed6ce21a5

    • SHA1

      4f6d054ed86c41b334af49a3bfaf42120fd2876c

    • SHA256

      30ac7415f1cdd5984cdfe15961eb46211c444786c453cfe8525dacd7c76c28b6

    • SHA512

      8b3726cbe99b7b05d155858f43b7c6010ecd71be42ffdb64f2e8da4de281fc3786494c66883567d26a82f3a33d543f495f328db58055ce88a82a769d627c1a10

    • SSDEEP

      6144:54+U6OuzhTIXJnxeecA9ikbl4yB6ETGzM0yT:a+U6O6eh9cA/lV6ETGw0yT

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks