General

  • Target

    JaffaCakes118_3eca8afc1a88735e283d8d27908f598b7c1576cdadeae279e867dd6ab6b1fc71

  • Size

    160KB

  • Sample

    241223-wdwtcawnh1

  • MD5

    8f8a68dd2c63d09ac1bd881360e2c93e

  • SHA1

    0ceb8f14b2e07b44accf504571ff517e65b467b4

  • SHA256

    3eca8afc1a88735e283d8d27908f598b7c1576cdadeae279e867dd6ab6b1fc71

  • SHA512

    6ce0c86e52e8241e303ed0372387a2f4dbd8e63bde335c3ece5e23816be87ba0040626be19db43c007994b1fbd408d145264181969d33da00ddd89e9dec014c6

  • SSDEEP

    3072:bUT2d85tleLD51fC5AHYEoefukoTFMpGmj08D:3y5tAL11fNHYafoMpX

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_3eca8afc1a88735e283d8d27908f598b7c1576cdadeae279e867dd6ab6b1fc71

    • Size

      160KB

    • MD5

      8f8a68dd2c63d09ac1bd881360e2c93e

    • SHA1

      0ceb8f14b2e07b44accf504571ff517e65b467b4

    • SHA256

      3eca8afc1a88735e283d8d27908f598b7c1576cdadeae279e867dd6ab6b1fc71

    • SHA512

      6ce0c86e52e8241e303ed0372387a2f4dbd8e63bde335c3ece5e23816be87ba0040626be19db43c007994b1fbd408d145264181969d33da00ddd89e9dec014c6

    • SSDEEP

      3072:bUT2d85tleLD51fC5AHYEoefukoTFMpGmj08D:3y5tAL11fNHYafoMpX

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks