General

  • Target

    JaffaCakes118_9a6a91c5ef63d32be3ede19727439d631b1cd76900675df74d2aaff21c0f528b

  • Size

    188KB

  • Sample

    241223-vv41lswkfk

  • MD5

    6f4f1c395166255fd23024fae5766b17

  • SHA1

    5e18bfcd30087d1d8eca223541ecff685a688286

  • SHA256

    9a6a91c5ef63d32be3ede19727439d631b1cd76900675df74d2aaff21c0f528b

  • SHA512

    f719b2ac956aa3e3adcc6629689c4c3457aa53c201235af0a675355c6944b580ebb4e6c65b5d85dfed897e4bfed394b40fb7a32c0d1e0c555af1ffe6c589cd65

  • SSDEEP

    3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzS9qM:Rq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_9a6a91c5ef63d32be3ede19727439d631b1cd76900675df74d2aaff21c0f528b

    • Size

      188KB

    • MD5

      6f4f1c395166255fd23024fae5766b17

    • SHA1

      5e18bfcd30087d1d8eca223541ecff685a688286

    • SHA256

      9a6a91c5ef63d32be3ede19727439d631b1cd76900675df74d2aaff21c0f528b

    • SHA512

      f719b2ac956aa3e3adcc6629689c4c3457aa53c201235af0a675355c6944b580ebb4e6c65b5d85dfed897e4bfed394b40fb7a32c0d1e0c555af1ffe6c589cd65

    • SSDEEP

      3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzS9qM:Rq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks