General

  • Target

    JaffaCakes118_59f6e800bf25d9a54d0a09690541b589092242391133a5fc454f5a88c0ebe24c

  • Size

    161KB

  • Sample

    241230-14648atpfz

  • MD5

    dae23bea43f5459f77af1394c317733e

  • SHA1

    eecb160c48d41befa99da9a4cbb05d9c014b12a3

  • SHA256

    59f6e800bf25d9a54d0a09690541b589092242391133a5fc454f5a88c0ebe24c

  • SHA512

    c83578b82a3d598652bfb0814e01b232c39687de34bc9e0dc3a3fe3ae6958e667e1ac83bbb28c72b667bd1ab8b2fccfc7cb11f8d75b2484d2c5cca5be3aacef9

  • SSDEEP

    3072:ok2X+QFg3UutDvUvoU8pz6EJEEhu6Tzace9kuaGA81/YXKHML/Yp8AF:GG3rUvoU4JE/Wzan9T7B/CKsL/Yy

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_59f6e800bf25d9a54d0a09690541b589092242391133a5fc454f5a88c0ebe24c

    • Size

      161KB

    • MD5

      dae23bea43f5459f77af1394c317733e

    • SHA1

      eecb160c48d41befa99da9a4cbb05d9c014b12a3

    • SHA256

      59f6e800bf25d9a54d0a09690541b589092242391133a5fc454f5a88c0ebe24c

    • SHA512

      c83578b82a3d598652bfb0814e01b232c39687de34bc9e0dc3a3fe3ae6958e667e1ac83bbb28c72b667bd1ab8b2fccfc7cb11f8d75b2484d2c5cca5be3aacef9

    • SSDEEP

      3072:ok2X+QFg3UutDvUvoU8pz6EJEEhu6Tzace9kuaGA81/YXKHML/Yp8AF:GG3rUvoU4JE/Wzan9T7B/CKsL/Yy

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks