General

  • Target

    JaffaCakes118_ac9647b5d24e6a40e5a677b1a89fb6da913cb904c6e099a8da52010b86977b8c

  • Size

    161KB

  • Sample

    241225-rz5wxsvpet

  • MD5

    5c7f1f9703b4c7e0fc0d046000960cb5

  • SHA1

    99e6cbf89bda76897add237bc30cc96a5642f1d3

  • SHA256

    ac9647b5d24e6a40e5a677b1a89fb6da913cb904c6e099a8da52010b86977b8c

  • SHA512

    170a45df832cd51a4500c1af8d052bbd5bcc5bde01ba5066236f466132ab0a5696cce1bfaa9dbf9c481def9a6cbe7cddc16dd3ca224304f5ebe68cbf9639e55c

  • SSDEEP

    3072:3tSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:9nS62Fl+pkeJl3CvRStrFl+EYi

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ac9647b5d24e6a40e5a677b1a89fb6da913cb904c6e099a8da52010b86977b8c

    • Size

      161KB

    • MD5

      5c7f1f9703b4c7e0fc0d046000960cb5

    • SHA1

      99e6cbf89bda76897add237bc30cc96a5642f1d3

    • SHA256

      ac9647b5d24e6a40e5a677b1a89fb6da913cb904c6e099a8da52010b86977b8c

    • SHA512

      170a45df832cd51a4500c1af8d052bbd5bcc5bde01ba5066236f466132ab0a5696cce1bfaa9dbf9c481def9a6cbe7cddc16dd3ca224304f5ebe68cbf9639e55c

    • SSDEEP

      3072:3tSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:9nS62Fl+pkeJl3CvRStrFl+EYi

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks