General

  • Target

    JaffaCakes118_04819216d4ddd38c2ef7e7b21ac0e00909984564b1980b35af6b0e6b01c26c77

  • Size

    188KB

  • Sample

    241230-3nq46strbk

  • MD5

    d1d990a4c94bf302cfeaa28b71e2f5dc

  • SHA1

    642894c617185e8bfb5b27d58dd3dc57298dc3c8

  • SHA256

    04819216d4ddd38c2ef7e7b21ac0e00909984564b1980b35af6b0e6b01c26c77

  • SHA512

    ecf74273817aa341e53c15d706ba52e2d3b3bdb5055f461818338f93d8eca72f08fc952110e95cfd2f01ca0963ef4cea6360d1f5f0fbd64b394a78fb64f28679

  • SSDEEP

    3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIze9qM:Eq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_04819216d4ddd38c2ef7e7b21ac0e00909984564b1980b35af6b0e6b01c26c77

    • Size

      188KB

    • MD5

      d1d990a4c94bf302cfeaa28b71e2f5dc

    • SHA1

      642894c617185e8bfb5b27d58dd3dc57298dc3c8

    • SHA256

      04819216d4ddd38c2ef7e7b21ac0e00909984564b1980b35af6b0e6b01c26c77

    • SHA512

      ecf74273817aa341e53c15d706ba52e2d3b3bdb5055f461818338f93d8eca72f08fc952110e95cfd2f01ca0963ef4cea6360d1f5f0fbd64b394a78fb64f28679

    • SSDEEP

      3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIze9qM:Eq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks