General

  • Target

    JaffaCakes118_faa607b5548a8d724e544a915df8ece3b6c0c6c58ad8d4363bfc1beb27172364

  • Size

    188KB

  • Sample

    241224-ln6q7atrer

  • MD5

    cd3bbfced0ecaba11a0b8437f6147f4f

  • SHA1

    48b5e0635ad05d3b11d782e3e70844dde3034935

  • SHA256

    faa607b5548a8d724e544a915df8ece3b6c0c6c58ad8d4363bfc1beb27172364

  • SHA512

    7cd58af1e084f0348e076b7c6281a6fd0c496edccd68de7eaaa20eff283e5355eba2256414426b4035668b3b8e053c192e7bc646ee0359663b32135aeba6b000

  • SSDEEP

    3072:NteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz29qM:5q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_faa607b5548a8d724e544a915df8ece3b6c0c6c58ad8d4363bfc1beb27172364

    • Size

      188KB

    • MD5

      cd3bbfced0ecaba11a0b8437f6147f4f

    • SHA1

      48b5e0635ad05d3b11d782e3e70844dde3034935

    • SHA256

      faa607b5548a8d724e544a915df8ece3b6c0c6c58ad8d4363bfc1beb27172364

    • SHA512

      7cd58af1e084f0348e076b7c6281a6fd0c496edccd68de7eaaa20eff283e5355eba2256414426b4035668b3b8e053c192e7bc646ee0359663b32135aeba6b000

    • SSDEEP

      3072:NteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz29qM:5q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks