General

  • Target

    JaffaCakes118_e2e8b803a05f5f35e6ff158885bc0c91a34f01c15a2945fc4b2e44928791b970

  • Size

    188KB

  • Sample

    241224-a4qjcswra1

  • MD5

    04ea55dc12fb5a0d2d8ae5fb2e7c18ac

  • SHA1

    b3be34658e6bea83e562c985e2530dd653e031b4

  • SHA256

    e2e8b803a05f5f35e6ff158885bc0c91a34f01c15a2945fc4b2e44928791b970

  • SHA512

    8395927a017ca4364c3ba4e34cea74001782a7b28020e67ab6a2d76972ac9e656fd129ce5b8abb0f5df8ba090f4502f6fa2e98d96be564a1d63d4b8a0967d583

  • SSDEEP

    3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:Eq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_e2e8b803a05f5f35e6ff158885bc0c91a34f01c15a2945fc4b2e44928791b970

    • Size

      188KB

    • MD5

      04ea55dc12fb5a0d2d8ae5fb2e7c18ac

    • SHA1

      b3be34658e6bea83e562c985e2530dd653e031b4

    • SHA256

      e2e8b803a05f5f35e6ff158885bc0c91a34f01c15a2945fc4b2e44928791b970

    • SHA512

      8395927a017ca4364c3ba4e34cea74001782a7b28020e67ab6a2d76972ac9e656fd129ce5b8abb0f5df8ba090f4502f6fa2e98d96be564a1d63d4b8a0967d583

    • SSDEEP

      3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:Eq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks