General

  • Target

    JaffaCakes118_03c1e7a134413c76c1c915028022b84686318ef561f8b0dab30d27980dc3dc17

  • Size

    170KB

  • Sample

    241223-wdsrpawnhz

  • MD5

    4d72b58183a6a4fb715558302138f5b1

  • SHA1

    0be623c69dc178ed5e2653b819e8c25f434ebf85

  • SHA256

    03c1e7a134413c76c1c915028022b84686318ef561f8b0dab30d27980dc3dc17

  • SHA512

    7829d124b65d05379f44404a5f436e136e3132bbec7460bdd598eb3fa2f1967c243b5cdc4b01331a8405c937492d8bf2f544ee57f0eb0003e75d025376ac53b8

  • SSDEEP

    3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_03c1e7a134413c76c1c915028022b84686318ef561f8b0dab30d27980dc3dc17

    • Size

      170KB

    • MD5

      4d72b58183a6a4fb715558302138f5b1

    • SHA1

      0be623c69dc178ed5e2653b819e8c25f434ebf85

    • SHA256

      03c1e7a134413c76c1c915028022b84686318ef561f8b0dab30d27980dc3dc17

    • SHA512

      7829d124b65d05379f44404a5f436e136e3132bbec7460bdd598eb3fa2f1967c243b5cdc4b01331a8405c937492d8bf2f544ee57f0eb0003e75d025376ac53b8

    • SSDEEP

      3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks