General

  • Target

    JaffaCakes118_aa7c075d0f781a428a782f1f0e70e6e4d37eeea436b043f95712cb4bea36302c

  • Size

    184KB

  • Sample

    241222-bqaresxmct

  • MD5

    e80d2ee90d381d6bcee2dd1be083e109

  • SHA1

    d224410f363d09596f4af2bcd12164ab4bd0eb6b

  • SHA256

    aa7c075d0f781a428a782f1f0e70e6e4d37eeea436b043f95712cb4bea36302c

  • SHA512

    576f6e78800eedaaee0f676fe2ed55235a0dd2734a63bf80c6474569424882d37fff81ce7787b5461e1e7594dae7a0f8a93952564dc41bb5753cbc44489790ef

  • SSDEEP

    3072:piLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoylzoxss7:piLVCIT4WK2z1W+CUHZj4Skq/eao4oC

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_aa7c075d0f781a428a782f1f0e70e6e4d37eeea436b043f95712cb4bea36302c

    • Size

      184KB

    • MD5

      e80d2ee90d381d6bcee2dd1be083e109

    • SHA1

      d224410f363d09596f4af2bcd12164ab4bd0eb6b

    • SHA256

      aa7c075d0f781a428a782f1f0e70e6e4d37eeea436b043f95712cb4bea36302c

    • SHA512

      576f6e78800eedaaee0f676fe2ed55235a0dd2734a63bf80c6474569424882d37fff81ce7787b5461e1e7594dae7a0f8a93952564dc41bb5753cbc44489790ef

    • SSDEEP

      3072:piLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoylzoxss7:piLVCIT4WK2z1W+CUHZj4Skq/eao4oC

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks