General

  • Target

    JaffaCakes118_81a7c20ce4a171cd9634a4cb9eb8be82c631ff3b3b53a1fbabb45a9452e97bcd

  • Size

    161KB

  • Sample

    241224-qeyrfaxrfw

  • MD5

    3244b4e2670552af04640163ded502b8

  • SHA1

    10c5640d689759e6f04cd7f744990b7a11345884

  • SHA256

    81a7c20ce4a171cd9634a4cb9eb8be82c631ff3b3b53a1fbabb45a9452e97bcd

  • SHA512

    e8c723b7eb238686cfb911bb3d12c47023340c510b6bee4d1048d2ac5e513d7adc1cc210152f1adbb96bbc5debee075dbc4a87f1a7dfa1d5f266de2871f1a63d

  • SSDEEP

    3072:KgSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2ZGkFY:xnS62Fl+pkeJl3CvRStrFl+EYM

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_81a7c20ce4a171cd9634a4cb9eb8be82c631ff3b3b53a1fbabb45a9452e97bcd

    • Size

      161KB

    • MD5

      3244b4e2670552af04640163ded502b8

    • SHA1

      10c5640d689759e6f04cd7f744990b7a11345884

    • SHA256

      81a7c20ce4a171cd9634a4cb9eb8be82c631ff3b3b53a1fbabb45a9452e97bcd

    • SHA512

      e8c723b7eb238686cfb911bb3d12c47023340c510b6bee4d1048d2ac5e513d7adc1cc210152f1adbb96bbc5debee075dbc4a87f1a7dfa1d5f266de2871f1a63d

    • SSDEEP

      3072:KgSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2ZGkFY:xnS62Fl+pkeJl3CvRStrFl+EYM

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks