General

  • Target

    JaffaCakes118_84ac92c8a04c17db84cc8261f74a1ffa6cdde09802d1f384abf6fc265bdd0cd2

  • Size

    171KB

  • Sample

    241223-1srv6asphl

  • MD5

    f8aac706032031b3c0bb8060b15cba1a

  • SHA1

    0513e7fa3c7caa6ffcf9478e5feb07c5a4f626e9

  • SHA256

    84ac92c8a04c17db84cc8261f74a1ffa6cdde09802d1f384abf6fc265bdd0cd2

  • SHA512

    58f3c6c3ffae5cef28eb612953f5cc5c370ee4588af0ac3ff9b898d992883e6b978a4013b5bebf13153d49e7bfc359a56ba3c6ebe2ea39462e65cd1bb7a43ebc

  • SSDEEP

    3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_84ac92c8a04c17db84cc8261f74a1ffa6cdde09802d1f384abf6fc265bdd0cd2

    • Size

      171KB

    • MD5

      f8aac706032031b3c0bb8060b15cba1a

    • SHA1

      0513e7fa3c7caa6ffcf9478e5feb07c5a4f626e9

    • SHA256

      84ac92c8a04c17db84cc8261f74a1ffa6cdde09802d1f384abf6fc265bdd0cd2

    • SHA512

      58f3c6c3ffae5cef28eb612953f5cc5c370ee4588af0ac3ff9b898d992883e6b978a4013b5bebf13153d49e7bfc359a56ba3c6ebe2ea39462e65cd1bb7a43ebc

    • SSDEEP

      3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks