General

  • Target

    JaffaCakes118_ed6fe32dfe8a6b75b64f4abe018e447a69a3d76d6c57253dd1a239ef4dc7ce06

  • Size

    184KB

  • Sample

    241230-19yp2a1pdr

  • MD5

    d17c44ed52d0a9ad1e69d57a3962d5f9

  • SHA1

    2e7d8dd1dddd850e9d1fa69ea93813ae7902397b

  • SHA256

    ed6fe32dfe8a6b75b64f4abe018e447a69a3d76d6c57253dd1a239ef4dc7ce06

  • SHA512

    db5e60e596f076570358768d68a559d0c3f41ce0a327bfe5bd37b198d2675b2e39a2f0878fde4a437e5bcb110060dac6411fc7b8c36b05aa8ab392cc87251ac9

  • SSDEEP

    3072:I92qSmHOhnWpPI1ybmJIiC00PArIojHTYVBCn+rs3Ss3qLMTNrLA:I9NSMOEpQ1Q3ODAr+VV

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ed6fe32dfe8a6b75b64f4abe018e447a69a3d76d6c57253dd1a239ef4dc7ce06

    • Size

      184KB

    • MD5

      d17c44ed52d0a9ad1e69d57a3962d5f9

    • SHA1

      2e7d8dd1dddd850e9d1fa69ea93813ae7902397b

    • SHA256

      ed6fe32dfe8a6b75b64f4abe018e447a69a3d76d6c57253dd1a239ef4dc7ce06

    • SHA512

      db5e60e596f076570358768d68a559d0c3f41ce0a327bfe5bd37b198d2675b2e39a2f0878fde4a437e5bcb110060dac6411fc7b8c36b05aa8ab392cc87251ac9

    • SSDEEP

      3072:I92qSmHOhnWpPI1ybmJIiC00PArIojHTYVBCn+rs3Ss3qLMTNrLA:I9NSMOEpQ1Q3ODAr+VV

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks