General

  • Target

    JaffaCakes118_653dff5f14f1100d896ffad7a82cc004a73e45084b93d22219c2b2951e4581cb

  • Size

    184KB

  • Sample

    241225-thp59axqfm

  • MD5

    a810e608bb53bf521868685f650ff3c4

  • SHA1

    671caf7deda09ccd99e9d2afad5b0aa4bdc64402

  • SHA256

    653dff5f14f1100d896ffad7a82cc004a73e45084b93d22219c2b2951e4581cb

  • SHA512

    50c93e5c2975e9bc7cdc718a03e2a4173394a684e9deac43b84f7075f1e5a0335a6bb8336b490b81e90467f4ab257840cdb925b9dec2c67316414600dff1c104

  • SSDEEP

    3072:LiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eao/lzoxss7:LiLVCIT4WK2z1W+CUHZj4Skq/eaodoC

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_653dff5f14f1100d896ffad7a82cc004a73e45084b93d22219c2b2951e4581cb

    • Size

      184KB

    • MD5

      a810e608bb53bf521868685f650ff3c4

    • SHA1

      671caf7deda09ccd99e9d2afad5b0aa4bdc64402

    • SHA256

      653dff5f14f1100d896ffad7a82cc004a73e45084b93d22219c2b2951e4581cb

    • SHA512

      50c93e5c2975e9bc7cdc718a03e2a4173394a684e9deac43b84f7075f1e5a0335a6bb8336b490b81e90467f4ab257840cdb925b9dec2c67316414600dff1c104

    • SSDEEP

      3072:LiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eao/lzoxss7:LiLVCIT4WK2z1W+CUHZj4Skq/eaodoC

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks