General

  • Target

    JaffaCakes118_e2a1847b0f767b1d321930dfae399b45a5e26e68ebe0b2b24f0296a9b6c53b3d

  • Size

    170KB

  • Sample

    241223-z63zxa1rcl

  • MD5

    8ee61313b10acd14e7ff08488ec812e5

  • SHA1

    35e1836c0d6f167ba8c1b52267d35c97feb1507c

  • SHA256

    e2a1847b0f767b1d321930dfae399b45a5e26e68ebe0b2b24f0296a9b6c53b3d

  • SHA512

    fefd8ab93fac861b826af9b21a65da426be070d8d90a27e1a7a4adc9581acef0bd99a3aa4a8b68ddae07e3e0043af8306993f0e41a2b853a5bb5dda8cd027c01

  • SSDEEP

    3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_e2a1847b0f767b1d321930dfae399b45a5e26e68ebe0b2b24f0296a9b6c53b3d

    • Size

      170KB

    • MD5

      8ee61313b10acd14e7ff08488ec812e5

    • SHA1

      35e1836c0d6f167ba8c1b52267d35c97feb1507c

    • SHA256

      e2a1847b0f767b1d321930dfae399b45a5e26e68ebe0b2b24f0296a9b6c53b3d

    • SHA512

      fefd8ab93fac861b826af9b21a65da426be070d8d90a27e1a7a4adc9581acef0bd99a3aa4a8b68ddae07e3e0043af8306993f0e41a2b853a5bb5dda8cd027c01

    • SSDEEP

      3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks