General

  • Target

    JaffaCakes118_95db80e6e4c9d7527b538e6b2ff917e6441441fd12f59cadf550ea83b45578db

  • Size

    188KB

  • Sample

    241224-bc2mzsxkcs

  • MD5

    acff2d7ae8d04da4dbb2e47d4b4c911b

  • SHA1

    fa47fded4e3595366c58fa42d18a87916648a2d7

  • SHA256

    95db80e6e4c9d7527b538e6b2ff917e6441441fd12f59cadf550ea83b45578db

  • SHA512

    18c056664328f8efd37dce8daac42a69c7abd9542b19965655c9aa0b9a7359004ca09bb0505afb881485bbd32276cdbfcd49e29be8ee1f2fef03ee8b5f5f9d83

  • SSDEEP

    3072:uteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzL9qM:Gq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_95db80e6e4c9d7527b538e6b2ff917e6441441fd12f59cadf550ea83b45578db

    • Size

      188KB

    • MD5

      acff2d7ae8d04da4dbb2e47d4b4c911b

    • SHA1

      fa47fded4e3595366c58fa42d18a87916648a2d7

    • SHA256

      95db80e6e4c9d7527b538e6b2ff917e6441441fd12f59cadf550ea83b45578db

    • SHA512

      18c056664328f8efd37dce8daac42a69c7abd9542b19965655c9aa0b9a7359004ca09bb0505afb881485bbd32276cdbfcd49e29be8ee1f2fef03ee8b5f5f9d83

    • SSDEEP

      3072:uteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzL9qM:Gq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks