General

  • Target

    JaffaCakes118_421b0242ab24c184a995d6cb5d2d579cf987535362092c25a287257b346e27a7

  • Size

    161KB

  • Sample

    241224-m1tstsvrdx

  • MD5

    dc8a8a820868b8cd50feb83b28296c09

  • SHA1

    28240f32f018a6de504bf34d0b890291526bb66a

  • SHA256

    421b0242ab24c184a995d6cb5d2d579cf987535362092c25a287257b346e27a7

  • SHA512

    07b4f35bdf2d2e2443e3671d513d0c7e832862dabf1b035511044d15a80728f84c2bc3644006627ec13b05eeb7a7547fad35d07d2529146e9645c7874dcf2678

  • SSDEEP

    3072:aC63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrU8Cx3:pa/jkvhSlP/7bg8aFnA3bra

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_421b0242ab24c184a995d6cb5d2d579cf987535362092c25a287257b346e27a7

    • Size

      161KB

    • MD5

      dc8a8a820868b8cd50feb83b28296c09

    • SHA1

      28240f32f018a6de504bf34d0b890291526bb66a

    • SHA256

      421b0242ab24c184a995d6cb5d2d579cf987535362092c25a287257b346e27a7

    • SHA512

      07b4f35bdf2d2e2443e3671d513d0c7e832862dabf1b035511044d15a80728f84c2bc3644006627ec13b05eeb7a7547fad35d07d2529146e9645c7874dcf2678

    • SSDEEP

      3072:aC63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrU8Cx3:pa/jkvhSlP/7bg8aFnA3bra

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks