General

  • Target

    JaffaCakes118_36c6e616cd342c819d600b26ae200ce6f75db14334a66f9612a61a05f248c5d5

  • Size

    188KB

  • Sample

    241224-cdcwpaylcw

  • MD5

    bdee990f700eedf791c3953b19fd23f9

  • SHA1

    1d53dea4071f4dfbd099e757664cb618e2ee2e4e

  • SHA256

    36c6e616cd342c819d600b26ae200ce6f75db14334a66f9612a61a05f248c5d5

  • SHA512

    6df73f8dbd2f4458d562e7671b980d7ba55898935d9bb8feee2377106fe1f8b411a0f0e36332233a83735445aab6a1eda6172d39d59167b5573126980c1ccd11

  • SSDEEP

    3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzd9qM:Rq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_36c6e616cd342c819d600b26ae200ce6f75db14334a66f9612a61a05f248c5d5

    • Size

      188KB

    • MD5

      bdee990f700eedf791c3953b19fd23f9

    • SHA1

      1d53dea4071f4dfbd099e757664cb618e2ee2e4e

    • SHA256

      36c6e616cd342c819d600b26ae200ce6f75db14334a66f9612a61a05f248c5d5

    • SHA512

      6df73f8dbd2f4458d562e7671b980d7ba55898935d9bb8feee2377106fe1f8b411a0f0e36332233a83735445aab6a1eda6172d39d59167b5573126980c1ccd11

    • SSDEEP

      3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzd9qM:Rq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks