General

  • Target

    JaffaCakes118_387d5f2fc7e806a0c4186269ea5a81aa8b36a7e44559ebdf07394a60d4c9ca7d

  • Size

    161KB

  • Sample

    241223-ttwgeavkbv

  • MD5

    f67d4a30ab3b504c5b0f9d8d8b58e1c5

  • SHA1

    51fbf1a5740c7f036d88028efb5952e26d7e2f7c

  • SHA256

    387d5f2fc7e806a0c4186269ea5a81aa8b36a7e44559ebdf07394a60d4c9ca7d

  • SHA512

    5245c352d6ca6cb9a33a691bfbdeacfa6b06a5805afbafb486f13a97217b46d962987bb1d184a0725fc264277c73b012c145f5942fd619770ed2deb006b23668

  • SSDEEP

    3072:pK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:TDBdOlG0nyg1DvwxgZ/v

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

45.55.134.126:443

67.207.83.96:8172

193.160.214.95:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_387d5f2fc7e806a0c4186269ea5a81aa8b36a7e44559ebdf07394a60d4c9ca7d

    • Size

      161KB

    • MD5

      f67d4a30ab3b504c5b0f9d8d8b58e1c5

    • SHA1

      51fbf1a5740c7f036d88028efb5952e26d7e2f7c

    • SHA256

      387d5f2fc7e806a0c4186269ea5a81aa8b36a7e44559ebdf07394a60d4c9ca7d

    • SHA512

      5245c352d6ca6cb9a33a691bfbdeacfa6b06a5805afbafb486f13a97217b46d962987bb1d184a0725fc264277c73b012c145f5942fd619770ed2deb006b23668

    • SSDEEP

      3072:pK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:TDBdOlG0nyg1DvwxgZ/v

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks