General

  • Target

    JaffaCakes118_932bd4151c228aae91827cb6a7f4daabfa53dc76e9e39c29e626ed8b0a1a786e

  • Size

    160KB

  • Sample

    241223-3zaassvrdx

  • MD5

    927140e41b96a0734a4c2a0a13cc9158

  • SHA1

    a53b6523317f206e6b39a377a941aee3116f2989

  • SHA256

    932bd4151c228aae91827cb6a7f4daabfa53dc76e9e39c29e626ed8b0a1a786e

  • SHA512

    9057136d16dd2ac5bd93809c33c7d78cf4ce2ceb47febac99f37b9f841c8e1c242e51b786e15e525e05bd0216392e52c72771c079e257e6198ad15970805cdbd

  • SSDEEP

    3072:kUT2d85tleLD51fC5AHYEoefukoTFMpGmj08D:+y5tAL11fNHYafoMpX

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_932bd4151c228aae91827cb6a7f4daabfa53dc76e9e39c29e626ed8b0a1a786e

    • Size

      160KB

    • MD5

      927140e41b96a0734a4c2a0a13cc9158

    • SHA1

      a53b6523317f206e6b39a377a941aee3116f2989

    • SHA256

      932bd4151c228aae91827cb6a7f4daabfa53dc76e9e39c29e626ed8b0a1a786e

    • SHA512

      9057136d16dd2ac5bd93809c33c7d78cf4ce2ceb47febac99f37b9f841c8e1c242e51b786e15e525e05bd0216392e52c72771c079e257e6198ad15970805cdbd

    • SSDEEP

      3072:kUT2d85tleLD51fC5AHYEoefukoTFMpGmj08D:+y5tAL11fNHYafoMpX

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks