General

  • Target

    JaffaCakes118_b8bf1faff17975a531cab0f698d3012d838b4e89400e6969d0a4996ec99e671b

  • Size

    170KB

  • Sample

    241224-bllccsxpfl

  • MD5

    09fc22d015501436d80b75b4a9514219

  • SHA1

    ba0acc4be50c8f4d8747dc5170f39ffd616a068d

  • SHA256

    b8bf1faff17975a531cab0f698d3012d838b4e89400e6969d0a4996ec99e671b

  • SHA512

    b8c123d2bbb6c05d2eded787f36be1380940cb0ae01575144688800bcb079dc34af22d0b6820f1a38ccbb8a1fce0fe48fc3508de7f5679c2ebad45345ed15ba8

  • SSDEEP

    3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b8bf1faff17975a531cab0f698d3012d838b4e89400e6969d0a4996ec99e671b

    • Size

      170KB

    • MD5

      09fc22d015501436d80b75b4a9514219

    • SHA1

      ba0acc4be50c8f4d8747dc5170f39ffd616a068d

    • SHA256

      b8bf1faff17975a531cab0f698d3012d838b4e89400e6969d0a4996ec99e671b

    • SHA512

      b8c123d2bbb6c05d2eded787f36be1380940cb0ae01575144688800bcb079dc34af22d0b6820f1a38ccbb8a1fce0fe48fc3508de7f5679c2ebad45345ed15ba8

    • SSDEEP

      3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks