General

  • Target

    JaffaCakes118_739f30c084e053f73b993d20900ea76a7b6655cb63be427382c9e03fdc37373c

  • Size

    188KB

  • Sample

    241224-mdfbxsvlcz

  • MD5

    28a8937f2ab7d955ac6be9da162a83e3

  • SHA1

    3dc6f9c9cfe691098b4aa92093f321a45612318d

  • SHA256

    739f30c084e053f73b993d20900ea76a7b6655cb63be427382c9e03fdc37373c

  • SHA512

    c7ffc076e78d8123bbba34a623f46c7f63d0fd1af60d6a6f7f897b6816c3ca4f15f7eef39ed35fe5776d25e2aec04e0ffcf62ee361d4c5c710200b01607ef859

  • SSDEEP

    3072:iteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz+9qM:Kq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_739f30c084e053f73b993d20900ea76a7b6655cb63be427382c9e03fdc37373c

    • Size

      188KB

    • MD5

      28a8937f2ab7d955ac6be9da162a83e3

    • SHA1

      3dc6f9c9cfe691098b4aa92093f321a45612318d

    • SHA256

      739f30c084e053f73b993d20900ea76a7b6655cb63be427382c9e03fdc37373c

    • SHA512

      c7ffc076e78d8123bbba34a623f46c7f63d0fd1af60d6a6f7f897b6816c3ca4f15f7eef39ed35fe5776d25e2aec04e0ffcf62ee361d4c5c710200b01607ef859

    • SSDEEP

      3072:iteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz+9qM:Kq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks