General

  • Target

    JaffaCakes118_2f26b2049336c0a0d06af2a3737c87e19acd0f6f57279ab354852f7b2eb52d52

  • Size

    188KB

  • Sample

    241224-lm39nstpgs

  • MD5

    352aacf84b3f933d5db5e533b786b8c3

  • SHA1

    47cdabe229f206de3b5da6b56266a2d7ac8b7352

  • SHA256

    2f26b2049336c0a0d06af2a3737c87e19acd0f6f57279ab354852f7b2eb52d52

  • SHA512

    79a65764e42f074332e006f159c5516eecbccf5aa9f4f4fdbae7ee8bc79a6888fee66d6188c471c70e8dac44cc132ae8ebc4fe2415468bfa035396999cda4053

  • SSDEEP

    3072:BteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzh9qM:Nq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_2f26b2049336c0a0d06af2a3737c87e19acd0f6f57279ab354852f7b2eb52d52

    • Size

      188KB

    • MD5

      352aacf84b3f933d5db5e533b786b8c3

    • SHA1

      47cdabe229f206de3b5da6b56266a2d7ac8b7352

    • SHA256

      2f26b2049336c0a0d06af2a3737c87e19acd0f6f57279ab354852f7b2eb52d52

    • SHA512

      79a65764e42f074332e006f159c5516eecbccf5aa9f4f4fdbae7ee8bc79a6888fee66d6188c471c70e8dac44cc132ae8ebc4fe2415468bfa035396999cda4053

    • SSDEEP

      3072:BteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzh9qM:Nq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks