General

  • Target

    JaffaCakes118_213fa1962c2f31580d60e0b7ec9dac4d1b31a088b41c97bee01f3f4323fcf7a2

  • Size

    170KB

  • Sample

    241224-lxkv3strfv

  • MD5

    738d96f89bfd8fdf767ff11e83a41be8

  • SHA1

    1476f669268eeabe6be5867a4e5756f47712cc48

  • SHA256

    213fa1962c2f31580d60e0b7ec9dac4d1b31a088b41c97bee01f3f4323fcf7a2

  • SHA512

    e67b95a1aadb0c2816be2c86978dc85acd347518ccb577135e657cdc078332cd5dad2f9290587d5235de0d13c3a6122af758ec643ae4bcac9757002fbd6a229f

  • SSDEEP

    3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_213fa1962c2f31580d60e0b7ec9dac4d1b31a088b41c97bee01f3f4323fcf7a2

    • Size

      170KB

    • MD5

      738d96f89bfd8fdf767ff11e83a41be8

    • SHA1

      1476f669268eeabe6be5867a4e5756f47712cc48

    • SHA256

      213fa1962c2f31580d60e0b7ec9dac4d1b31a088b41c97bee01f3f4323fcf7a2

    • SHA512

      e67b95a1aadb0c2816be2c86978dc85acd347518ccb577135e657cdc078332cd5dad2f9290587d5235de0d13c3a6122af758ec643ae4bcac9757002fbd6a229f

    • SSDEEP

      3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks