General

  • Target

    JaffaCakes118_b9b7631fdbbf1a7e6cbf30e3a4f224c4cb7d82b0be305ec2918f4139bf3f0752

  • Size

    188KB

  • Sample

    241224-ajmlzawley

  • MD5

    29d96b2a3a089d97641754a77bc19733

  • SHA1

    19d53e6d0cb6822f8c213e1ab830b8efc7fcd0d7

  • SHA256

    b9b7631fdbbf1a7e6cbf30e3a4f224c4cb7d82b0be305ec2918f4139bf3f0752

  • SHA512

    adf8b44c512dc4e54770cd512fe6380da21b9f166f517e61a2680d755c688bf7abddf29e201cd32f5c3b906e8e4040119218bd6ab14c1ec690049493f9710d9c

  • SSDEEP

    3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz59qM:Xq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b9b7631fdbbf1a7e6cbf30e3a4f224c4cb7d82b0be305ec2918f4139bf3f0752

    • Size

      188KB

    • MD5

      29d96b2a3a089d97641754a77bc19733

    • SHA1

      19d53e6d0cb6822f8c213e1ab830b8efc7fcd0d7

    • SHA256

      b9b7631fdbbf1a7e6cbf30e3a4f224c4cb7d82b0be305ec2918f4139bf3f0752

    • SHA512

      adf8b44c512dc4e54770cd512fe6380da21b9f166f517e61a2680d755c688bf7abddf29e201cd32f5c3b906e8e4040119218bd6ab14c1ec690049493f9710d9c

    • SSDEEP

      3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz59qM:Xq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks