General

  • Target

    f46f78ca95597fffeff734068e6ba681_JaffaCakes118

  • Size

    267KB

  • Sample

    240924-y4mpgawgqa

  • MD5

    f46f78ca95597fffeff734068e6ba681

  • SHA1

    5abe992df37b86efe5f7a1e019f101ee135a8a76

  • SHA256

    887a73dd182c064135d8451dc7a1c04b9dd19c89e1ec012b5dd22bac52116e6a

  • SHA512

    11ae1d7f2d4abd01866c09e44a028dcc2902a0ec5365239681fef066f52b8b09059abfeabd3e1d2039f6149f7dd0adb1c344d195c15c4a95f6f63c599e5eb6cd

  • SSDEEP

    3072:WKCvsQ1ZkyvvaVC5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCJvytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      f46f78ca95597fffeff734068e6ba681_JaffaCakes118

    • Size

      267KB

    • MD5

      f46f78ca95597fffeff734068e6ba681

    • SHA1

      5abe992df37b86efe5f7a1e019f101ee135a8a76

    • SHA256

      887a73dd182c064135d8451dc7a1c04b9dd19c89e1ec012b5dd22bac52116e6a

    • SHA512

      11ae1d7f2d4abd01866c09e44a028dcc2902a0ec5365239681fef066f52b8b09059abfeabd3e1d2039f6149f7dd0adb1c344d195c15c4a95f6f63c599e5eb6cd

    • SSDEEP

      3072:WKCvsQ1ZkyvvaVC5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCJvytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks