General

  • Target

    JaffaCakes118_26b2c9f377f5eb0af42dba73ba0511ea02cbff3235d1a1538cd82e4412fbd710

  • Size

    159KB

  • Sample

    241230-e6w65sykcq

  • MD5

    4ecb721bbff89e1b7b9ecd69b8cebb91

  • SHA1

    e7b39485e5561e2f64a6e66eb6e8100aeef9cbab

  • SHA256

    26b2c9f377f5eb0af42dba73ba0511ea02cbff3235d1a1538cd82e4412fbd710

  • SHA512

    d68f2165647f3f016f9bf62deb633e6905f3f1900dedc4704184d7b1dc569a441350b61a1b118093a42587c4a409fa45cb62541c1c96543f4eed833284cf1f3b

  • SSDEEP

    3072:yZ8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:/nClX8WZ7/HrRCADTR0VlZZw

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_26b2c9f377f5eb0af42dba73ba0511ea02cbff3235d1a1538cd82e4412fbd710

    • Size

      159KB

    • MD5

      4ecb721bbff89e1b7b9ecd69b8cebb91

    • SHA1

      e7b39485e5561e2f64a6e66eb6e8100aeef9cbab

    • SHA256

      26b2c9f377f5eb0af42dba73ba0511ea02cbff3235d1a1538cd82e4412fbd710

    • SHA512

      d68f2165647f3f016f9bf62deb633e6905f3f1900dedc4704184d7b1dc569a441350b61a1b118093a42587c4a409fa45cb62541c1c96543f4eed833284cf1f3b

    • SSDEEP

      3072:yZ8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:/nClX8WZ7/HrRCADTR0VlZZw

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks