General

  • Target

    e78685a388ca40a7593f4890370df604_JaffaCakes118

  • Size

    267KB

  • Sample

    240917-xytp6azeqb

  • MD5

    e78685a388ca40a7593f4890370df604

  • SHA1

    b203b716424fdc4e3d6037b7a6804d9366730a25

  • SHA256

    bfcf04008a57918b9e08e5489fa0a8193f0bee747686d1105e560f366fba5189

  • SHA512

    5b19c6f5ea971c89814d4379b53fea8e38220faf7ecfbf0a5cad9ad578cb22d102bfff7136744771be44979c6caed50d74f442dbb161eaff9299c623d0429945

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVx5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCEvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      e78685a388ca40a7593f4890370df604_JaffaCakes118

    • Size

      267KB

    • MD5

      e78685a388ca40a7593f4890370df604

    • SHA1

      b203b716424fdc4e3d6037b7a6804d9366730a25

    • SHA256

      bfcf04008a57918b9e08e5489fa0a8193f0bee747686d1105e560f366fba5189

    • SHA512

      5b19c6f5ea971c89814d4379b53fea8e38220faf7ecfbf0a5cad9ad578cb22d102bfff7136744771be44979c6caed50d74f442dbb161eaff9299c623d0429945

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVx5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCEvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks