General

  • Target

    JaffaCakes118_4c66a0997bc0f775717bbc354316b6d6b8c9d17bdbefb34f56ae599f778d79bf

  • Size

    166KB

  • Sample

    241230-ehzmcsxnam

  • MD5

    daf937c57f66da4fdf15667f8994925a

  • SHA1

    5c642db530f416375aec5d7880b7ee0a91964322

  • SHA256

    4c66a0997bc0f775717bbc354316b6d6b8c9d17bdbefb34f56ae599f778d79bf

  • SHA512

    60a952129d59f68f8ee8a4c62d6737edba92b23a5b19cc66cac2c5ec473e99e9c7ed72096ebc1e64e7b253e025257a146c40751f05f160f458cc6d17483f547c

  • SSDEEP

    3072:ZBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:HuXLcclWEc2HeSjNjGdegh

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

131.100.24.202:443

193.160.214.95:4125

67.43.4.76:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_4c66a0997bc0f775717bbc354316b6d6b8c9d17bdbefb34f56ae599f778d79bf

    • Size

      166KB

    • MD5

      daf937c57f66da4fdf15667f8994925a

    • SHA1

      5c642db530f416375aec5d7880b7ee0a91964322

    • SHA256

      4c66a0997bc0f775717bbc354316b6d6b8c9d17bdbefb34f56ae599f778d79bf

    • SHA512

      60a952129d59f68f8ee8a4c62d6737edba92b23a5b19cc66cac2c5ec473e99e9c7ed72096ebc1e64e7b253e025257a146c40751f05f160f458cc6d17483f547c

    • SSDEEP

      3072:ZBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:HuXLcclWEc2HeSjNjGdegh

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks