General

  • Target

    JaffaCakes118_d83a1efa71f3f40274c3dc9538ddd70c60e93eaad7360834f3dc07e1248d4b95

  • Size

    188KB

  • Sample

    241224-cwa5tayqh1

  • MD5

    94542d7d2b598efe59d0ae7f3a2b35e1

  • SHA1

    97eaf1a826109b85d26682cf6e1158f4dbf92770

  • SHA256

    d83a1efa71f3f40274c3dc9538ddd70c60e93eaad7360834f3dc07e1248d4b95

  • SHA512

    908048750714b31117b2e37e80ce8cba748a5211afe4e131f8442da87a59864e8071cbbc1cc401c525e4ca8647cea74ccc693ad7c5eeb0185811871e67744e32

  • SSDEEP

    3072:MteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzL9qM:wq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_d83a1efa71f3f40274c3dc9538ddd70c60e93eaad7360834f3dc07e1248d4b95

    • Size

      188KB

    • MD5

      94542d7d2b598efe59d0ae7f3a2b35e1

    • SHA1

      97eaf1a826109b85d26682cf6e1158f4dbf92770

    • SHA256

      d83a1efa71f3f40274c3dc9538ddd70c60e93eaad7360834f3dc07e1248d4b95

    • SHA512

      908048750714b31117b2e37e80ce8cba748a5211afe4e131f8442da87a59864e8071cbbc1cc401c525e4ca8647cea74ccc693ad7c5eeb0185811871e67744e32

    • SSDEEP

      3072:MteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzL9qM:wq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks