General

  • Target

    7a2aef21f55acd948924e7fd351e9e26_JaffaCakes118

  • Size

    576KB

  • Sample

    241028-sge38azmey

  • MD5

    7a2aef21f55acd948924e7fd351e9e26

  • SHA1

    b110aa77abf35f87b98dfe359fbcf900e118eb82

  • SHA256

    adaaddf7842e7092e792f10167bf0a810dee3fe12dc3118562e47db3c05dd6f5

  • SHA512

    6401b25dbfb6534db89914b99c473a575d291b9ef77ad0fb91f3573b78ddcdd2ce69cd05f790f8201eedf6ff575994bac64d7c197f4667180649c94235897f66

  • SSDEEP

    6144:VK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTrkGxon2QDP/ly+VQyMJ89n:VM+ZdkmHubeaCo6akl2A/sUQBJ89n

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

158.106.98.110:6225

149.210.181.82:10172

178.33.13.40:7443

rc4.plain
rc4.plain

Targets

    • Target

      7a2aef21f55acd948924e7fd351e9e26_JaffaCakes118

    • Size

      576KB

    • MD5

      7a2aef21f55acd948924e7fd351e9e26

    • SHA1

      b110aa77abf35f87b98dfe359fbcf900e118eb82

    • SHA256

      adaaddf7842e7092e792f10167bf0a810dee3fe12dc3118562e47db3c05dd6f5

    • SHA512

      6401b25dbfb6534db89914b99c473a575d291b9ef77ad0fb91f3573b78ddcdd2ce69cd05f790f8201eedf6ff575994bac64d7c197f4667180649c94235897f66

    • SSDEEP

      6144:VK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTrkGxon2QDP/ly+VQyMJ89n:VM+ZdkmHubeaCo6akl2A/sUQBJ89n

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks