General

  • Target

    d7044a93e62fc987856a17bd21b84245_JaffaCakes118

  • Size

    376KB

  • Sample

    240909-yw49jsxepk

  • MD5

    d7044a93e62fc987856a17bd21b84245

  • SHA1

    64eca0c5ff2564df922acef6b04613fd77a41d84

  • SHA256

    499ca0fe7ccf47d465bb6dc804b978cd2785e99e45dd257d15fcbf101b26bcab

  • SHA512

    2669f3d2ae37a36de1e8ee2714c6ffdd2cf29f2fff439000e588d87173850b446650b0316b95f6df746f390c40d7437bf719e42e7095ff9bfbada9b992a1c8f2

  • SSDEEP

    6144:1PRMLaqvB+YPrj0qfKNr3IBBX3k7UZpSN/wpgLhGew+GOeD6FAOCQx2Sl:1PRGLsYPrjbKluBHk7UZpowWDeD6FaSl

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

146.164.126.197:443

69.16.193.166:9443

193.90.12.122:3098

157.245.103.132:14043

rc4.plain
rc4.plain

Targets

    • Target

      d7044a93e62fc987856a17bd21b84245_JaffaCakes118

    • Size

      376KB

    • MD5

      d7044a93e62fc987856a17bd21b84245

    • SHA1

      64eca0c5ff2564df922acef6b04613fd77a41d84

    • SHA256

      499ca0fe7ccf47d465bb6dc804b978cd2785e99e45dd257d15fcbf101b26bcab

    • SHA512

      2669f3d2ae37a36de1e8ee2714c6ffdd2cf29f2fff439000e588d87173850b446650b0316b95f6df746f390c40d7437bf719e42e7095ff9bfbada9b992a1c8f2

    • SSDEEP

      6144:1PRMLaqvB+YPrj0qfKNr3IBBX3k7UZpSN/wpgLhGew+GOeD6FAOCQx2Sl:1PRGLsYPrjbKluBHk7UZpowWDeD6FaSl

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

MITRE ATT&CK Enterprise v15

Tasks