General

  • Target

    JaffaCakes118_7021b5f6ce99bd91dd35c9f77ab099ed06e88ac98f4c99cdc758fa8368c2c5b7

  • Size

    188KB

  • Sample

    241223-29r3xsvkdx

  • MD5

    4a80c1ef765f0be7cfe5a32bee5e920f

  • SHA1

    72590de1106fb7182e562e1647ffb6d3d0dad14b

  • SHA256

    7021b5f6ce99bd91dd35c9f77ab099ed06e88ac98f4c99cdc758fa8368c2c5b7

  • SHA512

    c008cdbb98c79c34b67ab66bc9218806333e765c01cd7083302c63c99ba39b5b1e7f62ecbe0b87946f8a33e792df768876ec0487f85f521b25bb67f30351dbbe

  • SSDEEP

    3072:LteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzY9qM:Dq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_7021b5f6ce99bd91dd35c9f77ab099ed06e88ac98f4c99cdc758fa8368c2c5b7

    • Size

      188KB

    • MD5

      4a80c1ef765f0be7cfe5a32bee5e920f

    • SHA1

      72590de1106fb7182e562e1647ffb6d3d0dad14b

    • SHA256

      7021b5f6ce99bd91dd35c9f77ab099ed06e88ac98f4c99cdc758fa8368c2c5b7

    • SHA512

      c008cdbb98c79c34b67ab66bc9218806333e765c01cd7083302c63c99ba39b5b1e7f62ecbe0b87946f8a33e792df768876ec0487f85f521b25bb67f30351dbbe

    • SSDEEP

      3072:LteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzY9qM:Dq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks