General

  • Target

    JaffaCakes118_557def3ee5188d8f148a4c0ddc400c6bb1af4378d1337c6713d1af4a151f920a

  • Size

    188KB

  • Sample

    241223-28dtxavjhw

  • MD5

    a115e6f10ebd5a1c28270f270ef29ef7

  • SHA1

    a9dcf6ffb573b4b804d27b1104cee8c43f31b94c

  • SHA256

    557def3ee5188d8f148a4c0ddc400c6bb1af4378d1337c6713d1af4a151f920a

  • SHA512

    9694a620f39c77a6c5e255c3fa17a7edd09e7694d771411b2da860927c8bf08f23a0d3025f1350517f42023915fc4339b8e89335ffaa06711ee3ae88052b0eff

  • SSDEEP

    3072:8teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzK9qM:Aq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_557def3ee5188d8f148a4c0ddc400c6bb1af4378d1337c6713d1af4a151f920a

    • Size

      188KB

    • MD5

      a115e6f10ebd5a1c28270f270ef29ef7

    • SHA1

      a9dcf6ffb573b4b804d27b1104cee8c43f31b94c

    • SHA256

      557def3ee5188d8f148a4c0ddc400c6bb1af4378d1337c6713d1af4a151f920a

    • SHA512

      9694a620f39c77a6c5e255c3fa17a7edd09e7694d771411b2da860927c8bf08f23a0d3025f1350517f42023915fc4339b8e89335ffaa06711ee3ae88052b0eff

    • SSDEEP

      3072:8teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzK9qM:Aq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks