General

  • Target

    JaffaCakes118_058387f10c342e7faa493b7f4ad6c67d64b8e231280658a15dadd21c233ac654

  • Size

    175KB

  • Sample

    241223-1sjjsaspgm

  • MD5

    b5ba38519f0a64c10b132399f0828782

  • SHA1

    77f77a13b1b97a1f395e0d927b84ccacbeb2805f

  • SHA256

    058387f10c342e7faa493b7f4ad6c67d64b8e231280658a15dadd21c233ac654

  • SHA512

    71d68fa88dce867499d82ec24a6c5ef16b8c4e787f0c75d626af22948183361fb0c59ee655dccc3a1e11da27ac3ac598180c4834c1a9cfc36a13a76c592676b2

  • SSDEEP

    3072:gUmpydLCFTvpvHZPYhIK2eX0wb0i/WrNnjgu45JCVmy4igfz3UIpjXZ:HmgpyZKCheFR/S/4uVZYfz3UIpj

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

96.30.31.236:2303

162.214.106.107:13783

46.231.204.10:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_058387f10c342e7faa493b7f4ad6c67d64b8e231280658a15dadd21c233ac654

    • Size

      175KB

    • MD5

      b5ba38519f0a64c10b132399f0828782

    • SHA1

      77f77a13b1b97a1f395e0d927b84ccacbeb2805f

    • SHA256

      058387f10c342e7faa493b7f4ad6c67d64b8e231280658a15dadd21c233ac654

    • SHA512

      71d68fa88dce867499d82ec24a6c5ef16b8c4e787f0c75d626af22948183361fb0c59ee655dccc3a1e11da27ac3ac598180c4834c1a9cfc36a13a76c592676b2

    • SSDEEP

      3072:gUmpydLCFTvpvHZPYhIK2eX0wb0i/WrNnjgu45JCVmy4igfz3UIpjXZ:HmgpyZKCheFR/S/4uVZYfz3UIpj

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks