General

  • Target

    JaffaCakes118_fab3d0d6e45538d2518474acabdcb84ea841e16c67a29052d78c30e9ae361e32

  • Size

    188KB

  • Sample

    241230-1g1zpazmbn

  • MD5

    65eb9bbc393896b779e42a45f2d2956f

  • SHA1

    b6d5135e05be280374076b17c9c3393b8deea70d

  • SHA256

    fab3d0d6e45538d2518474acabdcb84ea841e16c67a29052d78c30e9ae361e32

  • SHA512

    59d68f82893ea43025dd02ef49b2a31397b9061dc098cf396f724094d3e867fe073fa0f4e8947d036d98a1424ac4ccadf1206c5c6997525e41d5a03a56a28359

  • SSDEEP

    3072:2teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzZ9qM:+q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_fab3d0d6e45538d2518474acabdcb84ea841e16c67a29052d78c30e9ae361e32

    • Size

      188KB

    • MD5

      65eb9bbc393896b779e42a45f2d2956f

    • SHA1

      b6d5135e05be280374076b17c9c3393b8deea70d

    • SHA256

      fab3d0d6e45538d2518474acabdcb84ea841e16c67a29052d78c30e9ae361e32

    • SHA512

      59d68f82893ea43025dd02ef49b2a31397b9061dc098cf396f724094d3e867fe073fa0f4e8947d036d98a1424ac4ccadf1206c5c6997525e41d5a03a56a28359

    • SSDEEP

      3072:2teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzZ9qM:+q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks