General

  • Target

    JaffaCakes118_bca8ad474160b083bc9f19994bb36d4b1148a893a3ef30d75bceb0ead1a13a94

  • Size

    188KB

  • Sample

    241230-28b1bawlhz

  • MD5

    6f73e0d69ea0f6cc644b5cbc6d82857c

  • SHA1

    4b456476fb7f4e270bd7873de0f6b1e4a4f47448

  • SHA256

    bca8ad474160b083bc9f19994bb36d4b1148a893a3ef30d75bceb0ead1a13a94

  • SHA512

    cd7887c55dbfe4f6127a94df997640901f6a70ddb83e29f6b501613eec42ed0102a3bebe2afbdce546d07790634dae29921f95ec00f67215b9ea3cf873e89fde

  • SSDEEP

    3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:Rq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_bca8ad474160b083bc9f19994bb36d4b1148a893a3ef30d75bceb0ead1a13a94

    • Size

      188KB

    • MD5

      6f73e0d69ea0f6cc644b5cbc6d82857c

    • SHA1

      4b456476fb7f4e270bd7873de0f6b1e4a4f47448

    • SHA256

      bca8ad474160b083bc9f19994bb36d4b1148a893a3ef30d75bceb0ead1a13a94

    • SHA512

      cd7887c55dbfe4f6127a94df997640901f6a70ddb83e29f6b501613eec42ed0102a3bebe2afbdce546d07790634dae29921f95ec00f67215b9ea3cf873e89fde

    • SSDEEP

      3072:1teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:Rq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks