General

  • Target

    JaffaCakes118_eabb3439cd715043c556faf46122f6b977fc81c4baebdc29ce5ef8ca8d0ca43d

  • Size

    161KB

  • Sample

    241229-rpcsdstlby

  • MD5

    653354d25a00123e1293449889b8db8d

  • SHA1

    c323c63c16c7851e125bf24b1bf64386888f09cd

  • SHA256

    eabb3439cd715043c556faf46122f6b977fc81c4baebdc29ce5ef8ca8d0ca43d

  • SHA512

    d93b4b7853e29c6152449fa86a504069c98f1e700591c2525e5e8b30faa83917d30b08cebc52a9ec79965b284931eda5172a22628106bb061218d35f5273a174

  • SSDEEP

    3072:fnSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:vnS62Fl+pkeJl3CvRStrFl+EY0

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_eabb3439cd715043c556faf46122f6b977fc81c4baebdc29ce5ef8ca8d0ca43d

    • Size

      161KB

    • MD5

      653354d25a00123e1293449889b8db8d

    • SHA1

      c323c63c16c7851e125bf24b1bf64386888f09cd

    • SHA256

      eabb3439cd715043c556faf46122f6b977fc81c4baebdc29ce5ef8ca8d0ca43d

    • SHA512

      d93b4b7853e29c6152449fa86a504069c98f1e700591c2525e5e8b30faa83917d30b08cebc52a9ec79965b284931eda5172a22628106bb061218d35f5273a174

    • SSDEEP

      3072:fnSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:vnS62Fl+pkeJl3CvRStrFl+EY0

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks