General

  • Target

    JaffaCakes118_c874b9b9de5516b194dee9c30b29585cecfced50bc31a06e316853883384ca6c

  • Size

    184KB

  • Sample

    241225-xhmxnsspf1

  • MD5

    642af5845bd927e3d6205b535878b024

  • SHA1

    9b3534781a34aa0a7a04400859438159bf217bf3

  • SHA256

    c874b9b9de5516b194dee9c30b29585cecfced50bc31a06e316853883384ca6c

  • SHA512

    2584a5536b41e1ae46b11f6e6108b804ecda7f261be73968dadfb03be1f32a068ed91d5f61a98808f9d80eaaebd7a43f9a9f0e3d423bd5a21e0cac10e1b2ae2e

  • SSDEEP

    3072:XiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaojlzoxss7:XiLVCIT4WK2z1W+CUHZj4Skq/eao5oC

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_c874b9b9de5516b194dee9c30b29585cecfced50bc31a06e316853883384ca6c

    • Size

      184KB

    • MD5

      642af5845bd927e3d6205b535878b024

    • SHA1

      9b3534781a34aa0a7a04400859438159bf217bf3

    • SHA256

      c874b9b9de5516b194dee9c30b29585cecfced50bc31a06e316853883384ca6c

    • SHA512

      2584a5536b41e1ae46b11f6e6108b804ecda7f261be73968dadfb03be1f32a068ed91d5f61a98808f9d80eaaebd7a43f9a9f0e3d423bd5a21e0cac10e1b2ae2e

    • SSDEEP

      3072:XiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaojlzoxss7:XiLVCIT4WK2z1W+CUHZj4Skq/eao5oC

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks