General

  • Target

    JaffaCakes118_eff8cc86eeb0034a504ffe14132d171ddae0ab2494f17b29940bd825e47d03e2

  • Size

    188KB

  • Sample

    241223-wk5ptswqfq

  • MD5

    7a3acf77dcdccfbfd588afc779616d0b

  • SHA1

    c6786e1e4daf1daaf3a3b447b99596da20b9b2ff

  • SHA256

    eff8cc86eeb0034a504ffe14132d171ddae0ab2494f17b29940bd825e47d03e2

  • SHA512

    a0b9915248addc8685348d9362ecb72dc09923e77dc26bcbd0f0b6b6d5ed423fdcfd18bb127b4838a522f1d7b1d6b828debd79cabb05854be7ad127d3383db13

  • SSDEEP

    3072:mteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzw9qM:Oq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_eff8cc86eeb0034a504ffe14132d171ddae0ab2494f17b29940bd825e47d03e2

    • Size

      188KB

    • MD5

      7a3acf77dcdccfbfd588afc779616d0b

    • SHA1

      c6786e1e4daf1daaf3a3b447b99596da20b9b2ff

    • SHA256

      eff8cc86eeb0034a504ffe14132d171ddae0ab2494f17b29940bd825e47d03e2

    • SHA512

      a0b9915248addc8685348d9362ecb72dc09923e77dc26bcbd0f0b6b6d5ed423fdcfd18bb127b4838a522f1d7b1d6b828debd79cabb05854be7ad127d3383db13

    • SSDEEP

      3072:mteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzw9qM:Oq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks