General

  • Target

    JaffaCakes118_e9c1e0519d9ffa2741349c32e737d4e7e962b1cfe6c8afbcc3feba9eacf26acd

  • Size

    161KB

  • Sample

    241224-cbf6bsynap

  • MD5

    6fb5f11c910e3718444386ae43b96b92

  • SHA1

    cd0d821150e4d8d23623825cbb59cd6307d1a548

  • SHA256

    e9c1e0519d9ffa2741349c32e737d4e7e962b1cfe6c8afbcc3feba9eacf26acd

  • SHA512

    96905abc0e2f10c532a75086a6925430a871b49ba967e64c890f2a807f89e0f98247c9e67de61767b051d48473fa5118ed623149262ed281c8c4ab2adf7f7e97

  • SSDEEP

    3072:eB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:84KcMhVkbK3hDq9E8i

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.55.134.126:443

67.207.83.96:8172

193.160.214.95:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_e9c1e0519d9ffa2741349c32e737d4e7e962b1cfe6c8afbcc3feba9eacf26acd

    • Size

      161KB

    • MD5

      6fb5f11c910e3718444386ae43b96b92

    • SHA1

      cd0d821150e4d8d23623825cbb59cd6307d1a548

    • SHA256

      e9c1e0519d9ffa2741349c32e737d4e7e962b1cfe6c8afbcc3feba9eacf26acd

    • SHA512

      96905abc0e2f10c532a75086a6925430a871b49ba967e64c890f2a807f89e0f98247c9e67de61767b051d48473fa5118ed623149262ed281c8c4ab2adf7f7e97

    • SSDEEP

      3072:eB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:84KcMhVkbK3hDq9E8i

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks