General

  • Target

    JaffaCakes118_afa166029175b4ff7508142a037c0ab3af9070f6b3e8dac8b45dc35c36af10a2

  • Size

    170KB

  • Sample

    241230-2alf4a1pfq

  • MD5

    833f48084ecd7d11ffaf7ccba6c6ea2d

  • SHA1

    70ffcab84eab4991f1b85660cd13fc3c3d7ffc0c

  • SHA256

    afa166029175b4ff7508142a037c0ab3af9070f6b3e8dac8b45dc35c36af10a2

  • SHA512

    efe05133b524730afa872140dbc0a564aade0d691addc9774fe16bee08425050c8224fca6e78524798faa510f8759bfa32012a698b92b19a1b085881384d4dfc

  • SSDEEP

    3072:7qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:1VqNd+CIQHXu9VFmu0qU2CJ5

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_afa166029175b4ff7508142a037c0ab3af9070f6b3e8dac8b45dc35c36af10a2

    • Size

      170KB

    • MD5

      833f48084ecd7d11ffaf7ccba6c6ea2d

    • SHA1

      70ffcab84eab4991f1b85660cd13fc3c3d7ffc0c

    • SHA256

      afa166029175b4ff7508142a037c0ab3af9070f6b3e8dac8b45dc35c36af10a2

    • SHA512

      efe05133b524730afa872140dbc0a564aade0d691addc9774fe16bee08425050c8224fca6e78524798faa510f8759bfa32012a698b92b19a1b085881384d4dfc

    • SSDEEP

      3072:7qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:1VqNd+CIQHXu9VFmu0qU2CJ5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks