General

  • Target

    JaffaCakes118_abee8b0e3e51e1298cd3489d5b6914a6f5d2d30c734848628beb4d89156d0c43

  • Size

    161KB

  • Sample

    241230-egln4sxmfk

  • MD5

    5f961bb9083a6c2c4d4c7f2e7f735333

  • SHA1

    61ab3c414769110bc22ff4e01fbd94860c1cf1d6

  • SHA256

    abee8b0e3e51e1298cd3489d5b6914a6f5d2d30c734848628beb4d89156d0c43

  • SHA512

    cba9ff0491e6f531592bf2c7e6f55da37732c18a9a2a7c5345e9d6c45e0789d501d72b24d9140b663be6ec9e76f4494d1fc03d3a7eebf7d391cf5d200d904854

  • SSDEEP

    3072:mnSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:2nS62Fl+pkeJl3CvRStrFl+EY0

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

78.46.73.125:443

185.148.168.26:2303

66.113.160.126:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_abee8b0e3e51e1298cd3489d5b6914a6f5d2d30c734848628beb4d89156d0c43

    • Size

      161KB

    • MD5

      5f961bb9083a6c2c4d4c7f2e7f735333

    • SHA1

      61ab3c414769110bc22ff4e01fbd94860c1cf1d6

    • SHA256

      abee8b0e3e51e1298cd3489d5b6914a6f5d2d30c734848628beb4d89156d0c43

    • SHA512

      cba9ff0491e6f531592bf2c7e6f55da37732c18a9a2a7c5345e9d6c45e0789d501d72b24d9140b663be6ec9e76f4494d1fc03d3a7eebf7d391cf5d200d904854

    • SSDEEP

      3072:mnSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:2nS62Fl+pkeJl3CvRStrFl+EY0

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks