General

  • Target

    JaffaCakes118_ea78c844ef7ef73165c42e128d64dc756b0412af0ed8f2e37fcfdf9aa5966e7e

  • Size

    188KB

  • Sample

    241223-xhp22axpdr

  • MD5

    37756e283ef99a0d0fa2e0284a490a99

  • SHA1

    939d8e17cec4223d2f7d05f122b7af4baad5e25a

  • SHA256

    ea78c844ef7ef73165c42e128d64dc756b0412af0ed8f2e37fcfdf9aa5966e7e

  • SHA512

    ee3567648b3a03cc05ef55020ea5b76ce1c767cd3d72308a2e41353b80f13d2b3f94393c2b2ad954f924eae1032702853682b98f39a85494ed82babf78d49784

  • SSDEEP

    3072:dteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:pq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ea78c844ef7ef73165c42e128d64dc756b0412af0ed8f2e37fcfdf9aa5966e7e

    • Size

      188KB

    • MD5

      37756e283ef99a0d0fa2e0284a490a99

    • SHA1

      939d8e17cec4223d2f7d05f122b7af4baad5e25a

    • SHA256

      ea78c844ef7ef73165c42e128d64dc756b0412af0ed8f2e37fcfdf9aa5966e7e

    • SHA512

      ee3567648b3a03cc05ef55020ea5b76ce1c767cd3d72308a2e41353b80f13d2b3f94393c2b2ad954f924eae1032702853682b98f39a85494ed82babf78d49784

    • SSDEEP

      3072:dteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:pq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks