General

  • Target

    JaffaCakes118_a0d41e58aea7bfabb81bfbbfe9f24e426c0566d0c7a900bd979937eb7fd96b10

  • Size

    188KB

  • Sample

    241224-alwyeswmb1

  • MD5

    f0f583da1556bcaa6393d87b54e1c8a3

  • SHA1

    44c6b14ddb0821df40fed0cea6f54571f1fd25c2

  • SHA256

    a0d41e58aea7bfabb81bfbbfe9f24e426c0566d0c7a900bd979937eb7fd96b10

  • SHA512

    3485e99fe962970311170039964f960f4de6ef00bc518f0d79f4e936abb74b210cd4d2a3e24b61a85da189843cf1f44eea90d76d5dc336793bba52c87a722737

  • SSDEEP

    3072:0teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzB9qM:Iq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_a0d41e58aea7bfabb81bfbbfe9f24e426c0566d0c7a900bd979937eb7fd96b10

    • Size

      188KB

    • MD5

      f0f583da1556bcaa6393d87b54e1c8a3

    • SHA1

      44c6b14ddb0821df40fed0cea6f54571f1fd25c2

    • SHA256

      a0d41e58aea7bfabb81bfbbfe9f24e426c0566d0c7a900bd979937eb7fd96b10

    • SHA512

      3485e99fe962970311170039964f960f4de6ef00bc518f0d79f4e936abb74b210cd4d2a3e24b61a85da189843cf1f44eea90d76d5dc336793bba52c87a722737

    • SSDEEP

      3072:0teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzB9qM:Iq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks