General

  • Target

    JaffaCakes118_73ce6f8c56f540ab2b1ec8ba2e268bf2c936f53c3b1313f3923237825f7d99db

  • Size

    171KB

  • Sample

    241224-cqewtayrfn

  • MD5

    3fb9e3a5ae3783547784be5472d22a3e

  • SHA1

    222972d7f4ad46d02087cde2efc9c1fb08759b97

  • SHA256

    73ce6f8c56f540ab2b1ec8ba2e268bf2c936f53c3b1313f3923237825f7d99db

  • SHA512

    067dc70be1affe8f1a93c758985a47b5654f2a2d8e742068930406c34e50f072fc82ead659f87ca7277f291cf384c99b82b96feb9488210bb05832c28c22c222

  • SSDEEP

    3072:bi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:bH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_73ce6f8c56f540ab2b1ec8ba2e268bf2c936f53c3b1313f3923237825f7d99db

    • Size

      171KB

    • MD5

      3fb9e3a5ae3783547784be5472d22a3e

    • SHA1

      222972d7f4ad46d02087cde2efc9c1fb08759b97

    • SHA256

      73ce6f8c56f540ab2b1ec8ba2e268bf2c936f53c3b1313f3923237825f7d99db

    • SHA512

      067dc70be1affe8f1a93c758985a47b5654f2a2d8e742068930406c34e50f072fc82ead659f87ca7277f291cf384c99b82b96feb9488210bb05832c28c22c222

    • SSDEEP

      3072:bi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:bH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks