General

  • Target

    JaffaCakes118_51c2f5f7cbf37e8efe86c9d916a0315a58ef509bba7ff5c08d669be0b98bd019

  • Size

    160KB

  • Sample

    241224-l91gasvkgt

  • MD5

    38106eb0bc928fabc5473ae7c3a37f4c

  • SHA1

    88e599ac891745015ae57e404e26951e5cc71e77

  • SHA256

    51c2f5f7cbf37e8efe86c9d916a0315a58ef509bba7ff5c08d669be0b98bd019

  • SHA512

    e3777a421768c0491bd78f56e2dfab47929154d8b1ae0d4ca0a67a63f303507317923e609f1025bbb458c33aedef4d2937974337e492e73280e60e070e42062e

  • SSDEEP

    3072:quT2d85tleLD51fC5AHYEoefukoTFMpGmjb8D:uy5tAL11fNHYafoMpX

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_51c2f5f7cbf37e8efe86c9d916a0315a58ef509bba7ff5c08d669be0b98bd019

    • Size

      160KB

    • MD5

      38106eb0bc928fabc5473ae7c3a37f4c

    • SHA1

      88e599ac891745015ae57e404e26951e5cc71e77

    • SHA256

      51c2f5f7cbf37e8efe86c9d916a0315a58ef509bba7ff5c08d669be0b98bd019

    • SHA512

      e3777a421768c0491bd78f56e2dfab47929154d8b1ae0d4ca0a67a63f303507317923e609f1025bbb458c33aedef4d2937974337e492e73280e60e070e42062e

    • SSDEEP

      3072:quT2d85tleLD51fC5AHYEoefukoTFMpGmjb8D:uy5tAL11fNHYafoMpX

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks