General

  • Target

    JaffaCakes118_c2a8343a46d65a836c6f1a16027fb2f593507fb1252e435c7cb4be0d8249d9f7

  • Size

    171KB

  • Sample

    241224-bhd4waxlgw

  • MD5

    e1386dcf7fdb9e5e718f25cac3d91dde

  • SHA1

    34f40499375645dc60b758e6ba76d56ff87a41de

  • SHA256

    c2a8343a46d65a836c6f1a16027fb2f593507fb1252e435c7cb4be0d8249d9f7

  • SHA512

    4a0df96a51b45817de63e0b312cffd7f6bcc8eb83b59d80dce4df525c6d7deb43905dff169818a9b17e655fd9bb59a5e835303e468f32e9f6e2d0c1ff99f05ad

  • SSDEEP

    3072:xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:xH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_c2a8343a46d65a836c6f1a16027fb2f593507fb1252e435c7cb4be0d8249d9f7

    • Size

      171KB

    • MD5

      e1386dcf7fdb9e5e718f25cac3d91dde

    • SHA1

      34f40499375645dc60b758e6ba76d56ff87a41de

    • SHA256

      c2a8343a46d65a836c6f1a16027fb2f593507fb1252e435c7cb4be0d8249d9f7

    • SHA512

      4a0df96a51b45817de63e0b312cffd7f6bcc8eb83b59d80dce4df525c6d7deb43905dff169818a9b17e655fd9bb59a5e835303e468f32e9f6e2d0c1ff99f05ad

    • SSDEEP

      3072:xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:xH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks