General

  • Target

    JaffaCakes118_23739acfed27a3e3250db6a0b3f04c683e039238d4b21c9d34eb4fe1fb6b2d75

  • Size

    160KB

  • Sample

    241230-3p9ynsvjar

  • MD5

    4195f1c61dd20e0dee39e77b723b0515

  • SHA1

    327394b194422b39ebd8e46dc50319118feea5b0

  • SHA256

    23739acfed27a3e3250db6a0b3f04c683e039238d4b21c9d34eb4fe1fb6b2d75

  • SHA512

    aa7657b3daf6df39893236a9d5334cd4fc3bb10a39dd2efdcba56a3638cc9fb5f707d3e45bf3e331e6c16af254d55a27fbbc1c1c846e65a0024071f7f0c4faa7

  • SSDEEP

    3072:OnhVKBnUkeWA2/9JQMxWlSvZVljKwTTtCwV4W8fikW5SEnZ:Gi2PY9JQMo6nljK2TQ8kmf

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_23739acfed27a3e3250db6a0b3f04c683e039238d4b21c9d34eb4fe1fb6b2d75

    • Size

      160KB

    • MD5

      4195f1c61dd20e0dee39e77b723b0515

    • SHA1

      327394b194422b39ebd8e46dc50319118feea5b0

    • SHA256

      23739acfed27a3e3250db6a0b3f04c683e039238d4b21c9d34eb4fe1fb6b2d75

    • SHA512

      aa7657b3daf6df39893236a9d5334cd4fc3bb10a39dd2efdcba56a3638cc9fb5f707d3e45bf3e331e6c16af254d55a27fbbc1c1c846e65a0024071f7f0c4faa7

    • SSDEEP

      3072:OnhVKBnUkeWA2/9JQMxWlSvZVljKwTTtCwV4W8fikW5SEnZ:Gi2PY9JQMo6nljK2TQ8kmf

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks