General

  • Target

    JaffaCakes118_9da8023e22f8c865bd7e6c48863b7e5d8f7adad22ddea4fe74ac3423a438dd77

  • Size

    188KB

  • Sample

    241230-231fqawkcz

  • MD5

    7886d4df07b7975b62496a1e0de73941

  • SHA1

    b21e1cb6ce0efb03195300b6c72f719160e9a0f2

  • SHA256

    9da8023e22f8c865bd7e6c48863b7e5d8f7adad22ddea4fe74ac3423a438dd77

  • SHA512

    875dd028a834ec9ad99f793e8bda41ab1a9a460a87a533f60a7d0e06558901ba3c4c507484413935c46125decb62cb3625bc3bb05ecb8ed6d5118db9cdad9384

  • SSDEEP

    3072:wteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzw9qM:kq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_9da8023e22f8c865bd7e6c48863b7e5d8f7adad22ddea4fe74ac3423a438dd77

    • Size

      188KB

    • MD5

      7886d4df07b7975b62496a1e0de73941

    • SHA1

      b21e1cb6ce0efb03195300b6c72f719160e9a0f2

    • SHA256

      9da8023e22f8c865bd7e6c48863b7e5d8f7adad22ddea4fe74ac3423a438dd77

    • SHA512

      875dd028a834ec9ad99f793e8bda41ab1a9a460a87a533f60a7d0e06558901ba3c4c507484413935c46125decb62cb3625bc3bb05ecb8ed6d5118db9cdad9384

    • SSDEEP

      3072:wteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzw9qM:kq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks