Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_0bb9ac5911fae69ac94753efceac245b8fbdc1d8889d0171ddce7e2c956dc72c

  • Size

    184KB

  • Sample

    241224-bsxnzaxrar

  • MD5

    be529ae3d9ba5afdb0ef894cf6ce84b9

  • SHA1

    b0ff94e50e9ee282090fa7ad812c67f71efbd44d

  • SHA256

    0bb9ac5911fae69ac94753efceac245b8fbdc1d8889d0171ddce7e2c956dc72c

  • SHA512

    251c2d62b941e2a06118fc1f7b1b5e4aa27335ad9f089e61b13bad14f8c95b36c7e9c15adc3452a354ec8c53682a12d04e3c1ed6462482c55c99487a6bc14bdd

  • SSDEEP

    3072:xJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8Jja//2uFrSc:SfYOX+wTScR/Xzku9LVw8uG

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
1
XH2KyJtcJ7RSk5n0Ak2zUIsoefdhHZlKRYf
rc4.plain
1
cYEsjNtMnqhfNdGdtxJHObrdyxC7I2RsYqPuLirrwkWgKf0csGFj3Ow4lgY2bwEnd8mTqve

Targets

    • Target

      JaffaCakes118_0bb9ac5911fae69ac94753efceac245b8fbdc1d8889d0171ddce7e2c956dc72c

    • Size

      184KB

    • MD5

      be529ae3d9ba5afdb0ef894cf6ce84b9

    • SHA1

      b0ff94e50e9ee282090fa7ad812c67f71efbd44d

    • SHA256

      0bb9ac5911fae69ac94753efceac245b8fbdc1d8889d0171ddce7e2c956dc72c

    • SHA512

      251c2d62b941e2a06118fc1f7b1b5e4aa27335ad9f089e61b13bad14f8c95b36c7e9c15adc3452a354ec8c53682a12d04e3c1ed6462482c55c99487a6bc14bdd

    • SSDEEP

      3072:xJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8Jja//2uFrSc:SfYOX+wTScR/Xzku9LVw8uG

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.