General

  • Target

    JaffaCakes118_7c70f5d6ec86e0632b0f5a9f54de1772616d384515d91e17a7f01baedd4104c1

  • Size

    161KB

  • Sample

    241230-ezn7ysxrct

  • MD5

    cfcbfcc1a2ad4f95745988846a0e46f5

  • SHA1

    853bfb4b038752e400a3945f41a7b5e845b75284

  • SHA256

    7c70f5d6ec86e0632b0f5a9f54de1772616d384515d91e17a7f01baedd4104c1

  • SHA512

    634e635b68a9cc477486842d16b6adaaf3dca1894ebec80150da3f4d9a561b390e94065e9f0709e6be04ea626899979ab2debaefd83c8961b485419ca164e311

  • SSDEEP

    3072:Ym63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUZCx3:Ta/jkvhSlP/7bg8aFnA3brH

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_7c70f5d6ec86e0632b0f5a9f54de1772616d384515d91e17a7f01baedd4104c1

    • Size

      161KB

    • MD5

      cfcbfcc1a2ad4f95745988846a0e46f5

    • SHA1

      853bfb4b038752e400a3945f41a7b5e845b75284

    • SHA256

      7c70f5d6ec86e0632b0f5a9f54de1772616d384515d91e17a7f01baedd4104c1

    • SHA512

      634e635b68a9cc477486842d16b6adaaf3dca1894ebec80150da3f4d9a561b390e94065e9f0709e6be04ea626899979ab2debaefd83c8961b485419ca164e311

    • SSDEEP

      3072:Ym63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUZCx3:Ta/jkvhSlP/7bg8aFnA3brH

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks