General

  • Target

    JaffaCakes118_d6ab4c1820076564b9cf8575328e8ab0dcd91339c02a5c3dea4be4df06fc2ebf

  • Size

    188KB

  • Sample

    241223-2wzwlsvjcj

  • MD5

    18e9666a58a0cb67424499e3d12a1f1b

  • SHA1

    88c9dc1a0abf893588b60af67ced5759aa77c3c8

  • SHA256

    d6ab4c1820076564b9cf8575328e8ab0dcd91339c02a5c3dea4be4df06fc2ebf

  • SHA512

    58cdc121575c535c6a375adaafd7ad66d34685f43c3cc79ba68430730070fd6473cb87230eb0a3f9216d36dc121181d7273b7cd3942192fa1609f98a3ca5ed80

  • SSDEEP

    3072:WteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:eq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_d6ab4c1820076564b9cf8575328e8ab0dcd91339c02a5c3dea4be4df06fc2ebf

    • Size

      188KB

    • MD5

      18e9666a58a0cb67424499e3d12a1f1b

    • SHA1

      88c9dc1a0abf893588b60af67ced5759aa77c3c8

    • SHA256

      d6ab4c1820076564b9cf8575328e8ab0dcd91339c02a5c3dea4be4df06fc2ebf

    • SHA512

      58cdc121575c535c6a375adaafd7ad66d34685f43c3cc79ba68430730070fd6473cb87230eb0a3f9216d36dc121181d7273b7cd3942192fa1609f98a3ca5ed80

    • SSDEEP

      3072:WteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:eq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks