General

  • Target

    JaffaCakes118_d0ff397d6f12827d0c6b8a9da9676762d2832e9a1ca85c55082ac9ea3b3d9b09

  • Size

    188KB

  • Sample

    241223-zm5dma1lcm

  • MD5

    bc613d6607b5fe0bf8304bfc461916e4

  • SHA1

    ef7e6d2e4500fbca9227bbffe90519e38dcb9c6f

  • SHA256

    d0ff397d6f12827d0c6b8a9da9676762d2832e9a1ca85c55082ac9ea3b3d9b09

  • SHA512

    18ddbf2a4b8606270ad90f9f2d07cd754e639d1cd30f733368d0164fd1710ac12f392bd7476653857e40a73ef2f5dd3964fc3294e46c225dc762c7c53128df3d

  • SSDEEP

    3072:ateMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz/9qM:Sq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_d0ff397d6f12827d0c6b8a9da9676762d2832e9a1ca85c55082ac9ea3b3d9b09

    • Size

      188KB

    • MD5

      bc613d6607b5fe0bf8304bfc461916e4

    • SHA1

      ef7e6d2e4500fbca9227bbffe90519e38dcb9c6f

    • SHA256

      d0ff397d6f12827d0c6b8a9da9676762d2832e9a1ca85c55082ac9ea3b3d9b09

    • SHA512

      18ddbf2a4b8606270ad90f9f2d07cd754e639d1cd30f733368d0164fd1710ac12f392bd7476653857e40a73ef2f5dd3964fc3294e46c225dc762c7c53128df3d

    • SSDEEP

      3072:ateMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz/9qM:Sq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks