General

  • Target

    JaffaCakes118_000318b978118a0ddf5804e1e31ac47fca8ad34cdd38c52ff1272325de25dac5

  • Size

    150KB

  • Sample

    241222-hlbaqaxrex

  • MD5

    aaa4d9d717b5592644a06838b5f60898

  • SHA1

    dc2d331937d7861e0074ea176428eb754a2ff0c1

  • SHA256

    000318b978118a0ddf5804e1e31ac47fca8ad34cdd38c52ff1272325de25dac5

  • SHA512

    2be8263107244b816e2a1570246d3a2c8b03d7b40099fa8aacdf8f08a09ba5a56ec7b0be0276b1517af91fef478532e4f58b72a7c14db8211b642b60412367f2

  • SSDEEP

    3072:YvjlelJSST45/7XVCR0X6tepgrc5OEPX6rhXHSGm6qvVXOEJIlxxcIkf56G6+:Y0lJqpa0X6tepIEP6rzm6I3JuxcIO4Gv

Malware Config

Extracted

Family

icedid

C2

zomboboxer.top

Targets

    • Target

      csyj9.bin

    • Size

      240KB

    • MD5

      db1f692f30bec01c5b5ab09bcae2dbe0

    • SHA1

      42f28d7c75f3aba64eeef0a7ab6827e768812a26

    • SHA256

      f31146768e88b447a4fa65669c5511348872c8df40301453aede86336365d0b4

    • SHA512

      e3a417c9aaa63ae60f8080e0a4c222b8908176b404ea1d4b340c7bf4706e630dde1ada803b7865526b77a0f754c43cb19059b51a43919ce23467240e079064bb

    • SSDEEP

      3072:Su6Nt36EfNKj0li470vwt3nVr3DTFlxg9V2uFQ/iKEBLHOCEppy+:+Nx6Hj0cpvwt3VjDtgT2gQKKs1Epp

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • Icedid family

    • IcedID First Stage Loader

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks