General

  • Target

    JaffaCakes118_122bb19f495a69bfbb0e9c2d40c619d7a60cb29ecff47ec4158b9874e82e80eb

  • Size

    161KB

  • Sample

    241224-bk5plsxpdr

  • MD5

    497568f83c91f9a1939cf0ae0e04eb76

  • SHA1

    5535d3d98f5c929e0fbb94a4a73034b032d7e123

  • SHA256

    122bb19f495a69bfbb0e9c2d40c619d7a60cb29ecff47ec4158b9874e82e80eb

  • SHA512

    151db9a3e210ab0157065672240bf678837caa453517c87b111021ac4d232f1170fa47c6965c03624c0a916bb42d021aa7c49f511bf423096cb47f2a41180b7f

  • SSDEEP

    3072:mz63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUXCx3:Ia/jkvhSlP/7bg8aFnA3brJ

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_122bb19f495a69bfbb0e9c2d40c619d7a60cb29ecff47ec4158b9874e82e80eb

    • Size

      161KB

    • MD5

      497568f83c91f9a1939cf0ae0e04eb76

    • SHA1

      5535d3d98f5c929e0fbb94a4a73034b032d7e123

    • SHA256

      122bb19f495a69bfbb0e9c2d40c619d7a60cb29ecff47ec4158b9874e82e80eb

    • SHA512

      151db9a3e210ab0157065672240bf678837caa453517c87b111021ac4d232f1170fa47c6965c03624c0a916bb42d021aa7c49f511bf423096cb47f2a41180b7f

    • SSDEEP

      3072:mz63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUXCx3:Ia/jkvhSlP/7bg8aFnA3brJ

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks