General

  • Target

    JaffaCakes118_44fbbb3f9cf37c42e3d01fb55ec9f1980ded8acf355cc956ad5a9628560adf78

  • Size

    178KB

  • Sample

    241223-zxt1ms1mgv

  • MD5

    0286e22d6d276c68b151590135664f0f

  • SHA1

    56904150aa167b7583e8f456be2ef2d4ac06905c

  • SHA256

    44fbbb3f9cf37c42e3d01fb55ec9f1980ded8acf355cc956ad5a9628560adf78

  • SHA512

    692647a4650b7161cbd56c0c8de78c050f766437017d2c2f4ae1ac607b0fe4b8242bf714cf5d1b573a4f60a2ba0dbf0a151379a6d0c4e7fb30f7f5f56cdcb569

  • SSDEEP

    3072:eZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtlUucGZ2:eUAk9I4vgz/V2dulz6/hvOhG

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

142.93.223.149:443

128.199.36.62:4664

50.116.54.215:13786

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_44fbbb3f9cf37c42e3d01fb55ec9f1980ded8acf355cc956ad5a9628560adf78

    • Size

      178KB

    • MD5

      0286e22d6d276c68b151590135664f0f

    • SHA1

      56904150aa167b7583e8f456be2ef2d4ac06905c

    • SHA256

      44fbbb3f9cf37c42e3d01fb55ec9f1980ded8acf355cc956ad5a9628560adf78

    • SHA512

      692647a4650b7161cbd56c0c8de78c050f766437017d2c2f4ae1ac607b0fe4b8242bf714cf5d1b573a4f60a2ba0dbf0a151379a6d0c4e7fb30f7f5f56cdcb569

    • SSDEEP

      3072:eZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtlUucGZ2:eUAk9I4vgz/V2dulz6/hvOhG

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks