Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_e17fee45df22c1ab114754d28e6e469f4c5f587cb8996cc1ba317204e686581a

  • Size

    161KB

  • Sample

    241224-vbb6gssjgw

  • MD5

    1df660eb301146cd8795b37b0f065f2b

  • SHA1

    b0fea2ef74908691d57dac2f02e3f8e6ce73ac5a

  • SHA256

    e17fee45df22c1ab114754d28e6e469f4c5f587cb8996cc1ba317204e686581a

  • SHA512

    c6e321b586c2b85b3cd06f4c8e0754ca71ca1a1517de10e075a3d7e8a43f88aa533afaacd299bb65b0b8f94be280e7722e9f68ab43487ab2c19269e4f1d7c0ab

  • SSDEEP

    3072:3nSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:3nS62Fl+pkeJl3CvRStrFl+EY0

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
1
pK5evvTkrtXl1PdUwzbpkX0O3ZxXgoysjCME
rc4.plain
1
ntqn1EkZmmUoYMQPCPRqlhuLwfUs1imUpn8s4TcDWSSsOcwAchuhvuHdgMGmOB84m4IVTx

Targets

    • Target

      JaffaCakes118_e17fee45df22c1ab114754d28e6e469f4c5f587cb8996cc1ba317204e686581a

    • Size

      161KB

    • MD5

      1df660eb301146cd8795b37b0f065f2b

    • SHA1

      b0fea2ef74908691d57dac2f02e3f8e6ce73ac5a

    • SHA256

      e17fee45df22c1ab114754d28e6e469f4c5f587cb8996cc1ba317204e686581a

    • SHA512

      c6e321b586c2b85b3cd06f4c8e0754ca71ca1a1517de10e075a3d7e8a43f88aa533afaacd299bb65b0b8f94be280e7722e9f68ab43487ab2c19269e4f1d7c0ab

    • SSDEEP

      3072:3nSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:3nS62Fl+pkeJl3CvRStrFl+EY0

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.