General

  • Target

    JaffaCakes118_de2bec98bfb84c3fcb4c029c521aa72682c7e282611937eec7e502bfb633bd21

  • Size

    160KB

  • Sample

    241230-e4d8jsyjcw

  • MD5

    79978b3464d4dcf9b8d9c76623d65f57

  • SHA1

    40de5a8b3611a9e16500fb529419f308372af7ef

  • SHA256

    de2bec98bfb84c3fcb4c029c521aa72682c7e282611937eec7e502bfb633bd21

  • SHA512

    109424778078749632f3c148ed0f54dc2fb97bf03a4903a112f9a2378a42e6eaa3e66be885c4090143b801cda8b5f8ecd101af3342f3e22148354da39f2fbd09

  • SSDEEP

    3072:UWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:U42IfzNPnoeY8j3AsHGPXpHNj6rByM3

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_de2bec98bfb84c3fcb4c029c521aa72682c7e282611937eec7e502bfb633bd21

    • Size

      160KB

    • MD5

      79978b3464d4dcf9b8d9c76623d65f57

    • SHA1

      40de5a8b3611a9e16500fb529419f308372af7ef

    • SHA256

      de2bec98bfb84c3fcb4c029c521aa72682c7e282611937eec7e502bfb633bd21

    • SHA512

      109424778078749632f3c148ed0f54dc2fb97bf03a4903a112f9a2378a42e6eaa3e66be885c4090143b801cda8b5f8ecd101af3342f3e22148354da39f2fbd09

    • SSDEEP

      3072:UWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:U42IfzNPnoeY8j3AsHGPXpHNj6rByM3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks