General

  • Target

    JaffaCakes118_27b07c72e1a5c15bea5cc70b3c4543b9b42f84a5ce52afbaa172f097dbf10d42

  • Size

    177KB

  • Sample

    241223-znhk9a1lel

  • MD5

    fc1ab1c77d554d26ff179c5876523c3e

  • SHA1

    d47ef61d81204dc71b7fcdf35ac2a7c911ca3396

  • SHA256

    27b07c72e1a5c15bea5cc70b3c4543b9b42f84a5ce52afbaa172f097dbf10d42

  • SHA512

    2b9ee5efefa056622dd86b6275dbb9f34a6c0c74898129914c3e672a1cc81e56863b0ceb8b8eaa904d210496288f1ec4cee7eee8f227917100879e9b32a9d465

  • SSDEEP

    3072:WoNQK/z2dvUgKrjbeSUAjnERwDkCWptcvcb8qgAE0A2C8FQUVac8SSrKI6bl/g:5aIzLgKrjbvUAjERycp6c8qgATA2TQU3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.79.91.89:9987

157.245.231.228:6051

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_27b07c72e1a5c15bea5cc70b3c4543b9b42f84a5ce52afbaa172f097dbf10d42

    • Size

      177KB

    • MD5

      fc1ab1c77d554d26ff179c5876523c3e

    • SHA1

      d47ef61d81204dc71b7fcdf35ac2a7c911ca3396

    • SHA256

      27b07c72e1a5c15bea5cc70b3c4543b9b42f84a5ce52afbaa172f097dbf10d42

    • SHA512

      2b9ee5efefa056622dd86b6275dbb9f34a6c0c74898129914c3e672a1cc81e56863b0ceb8b8eaa904d210496288f1ec4cee7eee8f227917100879e9b32a9d465

    • SSDEEP

      3072:WoNQK/z2dvUgKrjbeSUAjnERwDkCWptcvcb8qgAE0A2C8FQUVac8SSrKI6bl/g:5aIzLgKrjbvUAjERycp6c8qgATA2TQU3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks