General

  • Target

    JaffaCakes118_ff52d02f17ddfd2101618c5a1c060effb09d9a188443f118e8609fc9de50143f

  • Size

    161KB

  • Sample

    241228-298qnsvlex

  • MD5

    3cc5c34ab181b989c3b27ad5f6d6a8fa

  • SHA1

    df4911d5027a1bdac1e2cb77bb28c836c5dc761f

  • SHA256

    ff52d02f17ddfd2101618c5a1c060effb09d9a188443f118e8609fc9de50143f

  • SHA512

    7ffb6f05afc00fe3cb8f3d4cb65b2881e3a8d55fd2d652f8f6c16e09e6d8410287cb59f2cbe62bcdc3b38193b4e1f905a3d73ee32edb168069b2e3fbccb90d3c

  • SSDEEP

    3072:/jSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd28GkFY:bnS62Fl+pkeJl3CvRStrFl+EYN

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ff52d02f17ddfd2101618c5a1c060effb09d9a188443f118e8609fc9de50143f

    • Size

      161KB

    • MD5

      3cc5c34ab181b989c3b27ad5f6d6a8fa

    • SHA1

      df4911d5027a1bdac1e2cb77bb28c836c5dc761f

    • SHA256

      ff52d02f17ddfd2101618c5a1c060effb09d9a188443f118e8609fc9de50143f

    • SHA512

      7ffb6f05afc00fe3cb8f3d4cb65b2881e3a8d55fd2d652f8f6c16e09e6d8410287cb59f2cbe62bcdc3b38193b4e1f905a3d73ee32edb168069b2e3fbccb90d3c

    • SSDEEP

      3072:/jSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd28GkFY:bnS62Fl+pkeJl3CvRStrFl+EYN

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks