General

  • Target

    JaffaCakes118_b30bada1a95956c8cdc4430d6daff6492329310e17c67e574fec0bd612101dbe

  • Size

    188KB

  • Sample

    241224-dsqlrszrdy

  • MD5

    ba5895ae5eb5d60252b18e5d3be2b5ab

  • SHA1

    5f0c5b05440e59e9e2a2dbeda8c0ee547d57c5f2

  • SHA256

    b30bada1a95956c8cdc4430d6daff6492329310e17c67e574fec0bd612101dbe

  • SHA512

    21b78724643747adc4dbe43db010acd3c2f7bb63f77d9b8741d6ec0176c7d4bf858996a98b095b400da079c92109a2e0ed6a655b6cd9da2077107a74b8a3fbb9

  • SSDEEP

    3072:FteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzq9qM:Bq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b30bada1a95956c8cdc4430d6daff6492329310e17c67e574fec0bd612101dbe

    • Size

      188KB

    • MD5

      ba5895ae5eb5d60252b18e5d3be2b5ab

    • SHA1

      5f0c5b05440e59e9e2a2dbeda8c0ee547d57c5f2

    • SHA256

      b30bada1a95956c8cdc4430d6daff6492329310e17c67e574fec0bd612101dbe

    • SHA512

      21b78724643747adc4dbe43db010acd3c2f7bb63f77d9b8741d6ec0176c7d4bf858996a98b095b400da079c92109a2e0ed6a655b6cd9da2077107a74b8a3fbb9

    • SSDEEP

      3072:FteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzq9qM:Bq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks