General

  • Target

    JaffaCakes118_d5ac349f6846f2f03c61b3cca635235a7212be97fd7c7ff681a8ba60e6b34aee

  • Size

    188KB

  • Sample

    241230-3b1g3stlcr

  • MD5

    a44b76193e54960657c95a79686bfeda

  • SHA1

    89349fd0cce36e0c3c3a43fb0ab4f9587349e31b

  • SHA256

    d5ac349f6846f2f03c61b3cca635235a7212be97fd7c7ff681a8ba60e6b34aee

  • SHA512

    691f241376ffd687b7a97a5f46defd23633912faa0b9fc24847475aab5483032a265c6a38eaa8ec6cee7bb1a7f356371f3198adb83b4df14d1ec39aa43e54fa0

  • SSDEEP

    3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:Xq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_d5ac349f6846f2f03c61b3cca635235a7212be97fd7c7ff681a8ba60e6b34aee

    • Size

      188KB

    • MD5

      a44b76193e54960657c95a79686bfeda

    • SHA1

      89349fd0cce36e0c3c3a43fb0ab4f9587349e31b

    • SHA256

      d5ac349f6846f2f03c61b3cca635235a7212be97fd7c7ff681a8ba60e6b34aee

    • SHA512

      691f241376ffd687b7a97a5f46defd23633912faa0b9fc24847475aab5483032a265c6a38eaa8ec6cee7bb1a7f356371f3198adb83b4df14d1ec39aa43e54fa0

    • SSDEEP

      3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:Xq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks