General

  • Target

    JaffaCakes118_ff8e65d1b35457f7c76dda7ef0ff0ffc59551ff8e21b99e7b1ce84021d106a5d

  • Size

    184KB

  • Sample

    241230-eatfdaxkfn

  • MD5

    1983f6113fd3157ec81efe5dc24c671f

  • SHA1

    0f18a16fc36a4a65fdbae9429b91337d20b6b7c7

  • SHA256

    ff8e65d1b35457f7c76dda7ef0ff0ffc59551ff8e21b99e7b1ce84021d106a5d

  • SHA512

    15d1f3150e61b29aeb49809eba2dc5d58b6732f0d29909557597864cdd6ed45441f9ee7c4e3166dc4dd1e4d548eff2296aa0791c90ddb7fd7fbca5d7f2265c6d

  • SSDEEP

    3072:qgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdg6dA4l:jPFkq6zOe5ilSanONd

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.75.201.2:443

158.223.1.108:6225

165.22.28.242:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ff8e65d1b35457f7c76dda7ef0ff0ffc59551ff8e21b99e7b1ce84021d106a5d

    • Size

      184KB

    • MD5

      1983f6113fd3157ec81efe5dc24c671f

    • SHA1

      0f18a16fc36a4a65fdbae9429b91337d20b6b7c7

    • SHA256

      ff8e65d1b35457f7c76dda7ef0ff0ffc59551ff8e21b99e7b1ce84021d106a5d

    • SHA512

      15d1f3150e61b29aeb49809eba2dc5d58b6732f0d29909557597864cdd6ed45441f9ee7c4e3166dc4dd1e4d548eff2296aa0791c90ddb7fd7fbca5d7f2265c6d

    • SSDEEP

      3072:qgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdg6dA4l:jPFkq6zOe5ilSanONd

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks