General

  • Target

    JaffaCakes118_840f23b68693163deb72893f250e3e891a9a002d6ef3dd91d7d854ab56d826d9

  • Size

    188KB

  • Sample

    241223-ybs1saynb1

  • MD5

    4535965ec10d9edeb818b3a780a1a283

  • SHA1

    6b21d3a2e393440e3e15083409df7eee1bb9ecd1

  • SHA256

    840f23b68693163deb72893f250e3e891a9a002d6ef3dd91d7d854ab56d826d9

  • SHA512

    597a9336776154d3362fd7e95babc2394c41b6a669b9c3a99fb49249ff09bf5de9bcb84903d780093116501658e01c8cad62ea94c03d7c708abe8a571c599ad6

  • SSDEEP

    3072:gteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzf9qM:0q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_840f23b68693163deb72893f250e3e891a9a002d6ef3dd91d7d854ab56d826d9

    • Size

      188KB

    • MD5

      4535965ec10d9edeb818b3a780a1a283

    • SHA1

      6b21d3a2e393440e3e15083409df7eee1bb9ecd1

    • SHA256

      840f23b68693163deb72893f250e3e891a9a002d6ef3dd91d7d854ab56d826d9

    • SHA512

      597a9336776154d3362fd7e95babc2394c41b6a669b9c3a99fb49249ff09bf5de9bcb84903d780093116501658e01c8cad62ea94c03d7c708abe8a571c599ad6

    • SSDEEP

      3072:gteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzf9qM:0q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks