General

  • Target

    e74dead42ca7e8f78eaebfc879d67c41_JaffaCakes118

  • Size

    267KB

  • Sample

    240917-vnhtssthrc

  • MD5

    e74dead42ca7e8f78eaebfc879d67c41

  • SHA1

    94944f45079f58367c0c21ee42fbdb4b87e8886b

  • SHA256

    436564b5e0223e8a953b527c86ca9184af8f2d97a8ef0e51193e8d343ae77c21

  • SHA512

    3de44c333a21e9739998239516f6f1b85a986af2db86551c2ec72daa9b8354cc16391923447bf235c89b49dddc9e6249c60ab6d8250c46bd9b6fbcdd0276934e

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVQ5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCvvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      e74dead42ca7e8f78eaebfc879d67c41_JaffaCakes118

    • Size

      267KB

    • MD5

      e74dead42ca7e8f78eaebfc879d67c41

    • SHA1

      94944f45079f58367c0c21ee42fbdb4b87e8886b

    • SHA256

      436564b5e0223e8a953b527c86ca9184af8f2d97a8ef0e51193e8d343ae77c21

    • SHA512

      3de44c333a21e9739998239516f6f1b85a986af2db86551c2ec72daa9b8354cc16391923447bf235c89b49dddc9e6249c60ab6d8250c46bd9b6fbcdd0276934e

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVQ5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCvvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks