General

  • Target

    JaffaCakes118_1d2b81dd9c7982e7dfb78d99b1e0aa20e9a2077947e929329be4d8edb1a56571

  • Size

    188KB

  • Sample

    241224-nh7gmswma1

  • MD5

    4b8a1fb35722f880e8993d225fd47068

  • SHA1

    753130ab5ffb457f746c3e1ca786c80c0931c06c

  • SHA256

    1d2b81dd9c7982e7dfb78d99b1e0aa20e9a2077947e929329be4d8edb1a56571

  • SHA512

    2c2790e5a535ed3a01d1c60c4bcdf468c1108eb5888e3e10738e4e0069eead67685198decc946a11b94683cdca3ad6a6ca41dd44c88b43a89b8f2140182201cd

  • SSDEEP

    3072:GteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzg9qM:uq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_1d2b81dd9c7982e7dfb78d99b1e0aa20e9a2077947e929329be4d8edb1a56571

    • Size

      188KB

    • MD5

      4b8a1fb35722f880e8993d225fd47068

    • SHA1

      753130ab5ffb457f746c3e1ca786c80c0931c06c

    • SHA256

      1d2b81dd9c7982e7dfb78d99b1e0aa20e9a2077947e929329be4d8edb1a56571

    • SHA512

      2c2790e5a535ed3a01d1c60c4bcdf468c1108eb5888e3e10738e4e0069eead67685198decc946a11b94683cdca3ad6a6ca41dd44c88b43a89b8f2140182201cd

    • SSDEEP

      3072:GteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzg9qM:uq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks