General

  • Target

    JaffaCakes118_6330602651fa69e9328e295b94728cbcc450aeacf2116ad9eced7b731cd10520

  • Size

    188KB

  • Sample

    241223-131aaasrd1

  • MD5

    669378f3915ecbfe9a5279e3038c0f4c

  • SHA1

    924be52dd16d614e8cf5af61abcc2c4771e7c597

  • SHA256

    6330602651fa69e9328e295b94728cbcc450aeacf2116ad9eced7b731cd10520

  • SHA512

    633f4a099c143ab1bdf9d182b2c82d7b0a91f73b3a9d310a373a64d4fd15c8d83a5cb1d03aedd5fe16a5cdbf683bbcb741dd8b97c14601629c54b9cf3e5358e9

  • SSDEEP

    3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzp9qM:Rq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_6330602651fa69e9328e295b94728cbcc450aeacf2116ad9eced7b731cd10520

    • Size

      188KB

    • MD5

      669378f3915ecbfe9a5279e3038c0f4c

    • SHA1

      924be52dd16d614e8cf5af61abcc2c4771e7c597

    • SHA256

      6330602651fa69e9328e295b94728cbcc450aeacf2116ad9eced7b731cd10520

    • SHA512

      633f4a099c143ab1bdf9d182b2c82d7b0a91f73b3a9d310a373a64d4fd15c8d83a5cb1d03aedd5fe16a5cdbf683bbcb741dd8b97c14601629c54b9cf3e5358e9

    • SSDEEP

      3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzp9qM:Rq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks