General

  • Target

    JaffaCakes118_588231c6c631c119f456621357b04836b38c5132604a9c2dfbce3b95debc6666

  • Size

    188KB

  • Sample

    241223-y57e9szpdm

  • MD5

    ee7ae65ac3821d35cd20f8c15591ae05

  • SHA1

    38f15f63c438bc05e85a6ad2e8457c1ee37b2c0a

  • SHA256

    588231c6c631c119f456621357b04836b38c5132604a9c2dfbce3b95debc6666

  • SHA512

    efc3a655c597f40f9e89249ec610fa4d06c4fefb64f47310986baf3b840eaa0f58e79ee4b43c5b471cd52b8ec2f1f3c5cc36eded6bbafd04c2669b6dac0b902b

  • SSDEEP

    3072:NteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:5q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_588231c6c631c119f456621357b04836b38c5132604a9c2dfbce3b95debc6666

    • Size

      188KB

    • MD5

      ee7ae65ac3821d35cd20f8c15591ae05

    • SHA1

      38f15f63c438bc05e85a6ad2e8457c1ee37b2c0a

    • SHA256

      588231c6c631c119f456621357b04836b38c5132604a9c2dfbce3b95debc6666

    • SHA512

      efc3a655c597f40f9e89249ec610fa4d06c4fefb64f47310986baf3b840eaa0f58e79ee4b43c5b471cd52b8ec2f1f3c5cc36eded6bbafd04c2669b6dac0b902b

    • SSDEEP

      3072:NteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:5q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks