General

  • Target

    da85aa58348e416f43080e82388d7c81_JaffaCakes118

  • Size

    214KB

  • Sample

    240911-rj1bhavfmc

  • MD5

    da85aa58348e416f43080e82388d7c81

  • SHA1

    0aca3da36e5aa2ae7f6a34004c75ae24ea7e5128

  • SHA256

    c24e8099dffe2d9ddebc10b44b6d992043a7a88f0c24bdd7b462e750813dd92e

  • SHA512

    2607778d7b158e835a834a79476f93678e6245d92398d7ee0e0c67112d164ab7042c3df9dbc001019fc99fdc7dc2785d176c77ab2dc4c8cc63e7de1744e40257

  • SSDEEP

    6144:54+U6OuzhTIXJnxeecA9ikbl4yB6ETGzM0yT:a+U6Oyeh9cA/lV6ETGw0yT

Malware Config

Extracted

Family

icedid

C2

ldrshekel.casa

Targets

    • Target

      da85aa58348e416f43080e82388d7c81_JaffaCakes118

    • Size

      214KB

    • MD5

      da85aa58348e416f43080e82388d7c81

    • SHA1

      0aca3da36e5aa2ae7f6a34004c75ae24ea7e5128

    • SHA256

      c24e8099dffe2d9ddebc10b44b6d992043a7a88f0c24bdd7b462e750813dd92e

    • SHA512

      2607778d7b158e835a834a79476f93678e6245d92398d7ee0e0c67112d164ab7042c3df9dbc001019fc99fdc7dc2785d176c77ab2dc4c8cc63e7de1744e40257

    • SSDEEP

      6144:54+U6OuzhTIXJnxeecA9ikbl4yB6ETGzM0yT:a+U6Oyeh9cA/lV6ETGw0yT

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks