General

  • Target

    JaffaCakes118_931a0c1826a0a27733ae8b04a2fc290ca0e4c8d5849da82d1c096e8ba5ac67e0

  • Size

    161KB

  • Sample

    241224-x2yhhsvkhz

  • MD5

    014be89ce7287dc6d166d2dbc5d9b129

  • SHA1

    bf03a58789188593b17482e209ee644abcf0876e

  • SHA256

    931a0c1826a0a27733ae8b04a2fc290ca0e4c8d5849da82d1c096e8ba5ac67e0

  • SHA512

    e92664422571b19ff1e9ab8480ba3cb6588cf98f5a9d9f4f1c9fc6b7b5cb1db8b3e8e6426e615dfaa47e73be257ad709865b2c1e9851b2324384ef8fb8603e92

  • SSDEEP

    3072:F1Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2wGkFY:fnS62Fl+pkeJl3CvRStrFl+EYh

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_931a0c1826a0a27733ae8b04a2fc290ca0e4c8d5849da82d1c096e8ba5ac67e0

    • Size

      161KB

    • MD5

      014be89ce7287dc6d166d2dbc5d9b129

    • SHA1

      bf03a58789188593b17482e209ee644abcf0876e

    • SHA256

      931a0c1826a0a27733ae8b04a2fc290ca0e4c8d5849da82d1c096e8ba5ac67e0

    • SHA512

      e92664422571b19ff1e9ab8480ba3cb6588cf98f5a9d9f4f1c9fc6b7b5cb1db8b3e8e6426e615dfaa47e73be257ad709865b2c1e9851b2324384ef8fb8603e92

    • SSDEEP

      3072:F1Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2wGkFY:fnS62Fl+pkeJl3CvRStrFl+EYh

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks