General

  • Target

    JaffaCakes118_f9c30dacc9dcbd4f140b5ac4e4bbe1e1a677e0f76c80434b1af26f9aad39f16c

  • Size

    188KB

  • Sample

    241224-k4668atmdm

  • MD5

    407db6cadf1475d180128db30a25ee87

  • SHA1

    4b7dde89c1a9f6c567af54d28355001c6f974757

  • SHA256

    f9c30dacc9dcbd4f140b5ac4e4bbe1e1a677e0f76c80434b1af26f9aad39f16c

  • SHA512

    c418f0eebbedd2a17c673d5a2b0beb719377a588fad8b91d97aafd7529b06d6ff48b8b64e3c5e0bde6002a757a7cd498fd84e472359554419870c451689530fb

  • SSDEEP

    3072:qteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:Cq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_f9c30dacc9dcbd4f140b5ac4e4bbe1e1a677e0f76c80434b1af26f9aad39f16c

    • Size

      188KB

    • MD5

      407db6cadf1475d180128db30a25ee87

    • SHA1

      4b7dde89c1a9f6c567af54d28355001c6f974757

    • SHA256

      f9c30dacc9dcbd4f140b5ac4e4bbe1e1a677e0f76c80434b1af26f9aad39f16c

    • SHA512

      c418f0eebbedd2a17c673d5a2b0beb719377a588fad8b91d97aafd7529b06d6ff48b8b64e3c5e0bde6002a757a7cd498fd84e472359554419870c451689530fb

    • SSDEEP

      3072:qteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:Cq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks