General

  • Target

    JaffaCakes118_5903aa7e699f40328fe02db0e338061772cc0ad0bd2d243584c09ef534749090

  • Size

    170KB

  • Sample

    241230-1gd5xssnht

  • MD5

    a0179641b3567f1ec5eed8216e97c748

  • SHA1

    406a54c8a6f91594eaa07cdddd85a917c2a8ddc8

  • SHA256

    5903aa7e699f40328fe02db0e338061772cc0ad0bd2d243584c09ef534749090

  • SHA512

    fbf5501ef808eab4a7a639478056dbacbd2947479e6802d09240ec3b81553fcfb05e56d176ca6780aedf6e84b53bff71c6f417579e3e0ac2aa66965b1f65ac76

  • SSDEEP

    3072:4qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:WVqNd+CIQHXu9VFmu0qU2CJ5

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_5903aa7e699f40328fe02db0e338061772cc0ad0bd2d243584c09ef534749090

    • Size

      170KB

    • MD5

      a0179641b3567f1ec5eed8216e97c748

    • SHA1

      406a54c8a6f91594eaa07cdddd85a917c2a8ddc8

    • SHA256

      5903aa7e699f40328fe02db0e338061772cc0ad0bd2d243584c09ef534749090

    • SHA512

      fbf5501ef808eab4a7a639478056dbacbd2947479e6802d09240ec3b81553fcfb05e56d176ca6780aedf6e84b53bff71c6f417579e3e0ac2aa66965b1f65ac76

    • SSDEEP

      3072:4qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:WVqNd+CIQHXu9VFmu0qU2CJ5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks