General

  • Target

    fc15dd26863e502c152feae55e195d33_JaffaCakes118

  • Size

    267KB

  • Sample

    240928-mcjyqazgqr

  • MD5

    fc15dd26863e502c152feae55e195d33

  • SHA1

    149b729a72bb833b35ef98f44c65e0e7a09097f4

  • SHA256

    c8123e802b108c2385b8ba42a7f34eb2eb6bc2fb09bc677ba5397018820c4771

  • SHA512

    b4906b5c855fcedd573c22df692847f5ff7ba0b1963ea550ef18adfbf4348b76f6df66bc3866c6ea76b1d4a8e7ee9a471856dda8360d6fb6839a5255639a2faf

  • SSDEEP

    3072:WKCvsQ1ZkyvvaV25wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC1vytr7UtkiBvPLiAOg3kaeXV6y

Malware Config

Extracted

Family

icedid

C2

wertigohol.click

Targets

    • Target

      fc15dd26863e502c152feae55e195d33_JaffaCakes118

    • Size

      267KB

    • MD5

      fc15dd26863e502c152feae55e195d33

    • SHA1

      149b729a72bb833b35ef98f44c65e0e7a09097f4

    • SHA256

      c8123e802b108c2385b8ba42a7f34eb2eb6bc2fb09bc677ba5397018820c4771

    • SHA512

      b4906b5c855fcedd573c22df692847f5ff7ba0b1963ea550ef18adfbf4348b76f6df66bc3866c6ea76b1d4a8e7ee9a471856dda8360d6fb6839a5255639a2faf

    • SSDEEP

      3072:WKCvsQ1ZkyvvaV25wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoC1vytr7UtkiBvPLiAOg3kaeXV6y

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks