General

  • Target

    JaffaCakes118_350c3b887939d6d4f1aafc4b36e1864827103bce1d7a4750030b6a15607c64c3

  • Size

    171KB

  • Sample

    241223-wrb14awre1

  • MD5

    f3753f824bb7b33d0fca9eb941feb001

  • SHA1

    d7c244e6106a46e8582baa07f5638f3e37940fa1

  • SHA256

    350c3b887939d6d4f1aafc4b36e1864827103bce1d7a4750030b6a15607c64c3

  • SHA512

    b4f59925c5178447a46fff794ffabc3800d135efeb0ff2768523b0cbda899a27dc595c3e1b453be4eb1b015eb9d87cc5f0dadf7d3da37e4dd14e29e1524c1c8c

  • SSDEEP

    3072:Gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:GH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_350c3b887939d6d4f1aafc4b36e1864827103bce1d7a4750030b6a15607c64c3

    • Size

      171KB

    • MD5

      f3753f824bb7b33d0fca9eb941feb001

    • SHA1

      d7c244e6106a46e8582baa07f5638f3e37940fa1

    • SHA256

      350c3b887939d6d4f1aafc4b36e1864827103bce1d7a4750030b6a15607c64c3

    • SHA512

      b4f59925c5178447a46fff794ffabc3800d135efeb0ff2768523b0cbda899a27dc595c3e1b453be4eb1b015eb9d87cc5f0dadf7d3da37e4dd14e29e1524c1c8c

    • SSDEEP

      3072:Gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:GH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks