General

  • Target

    JaffaCakes118_a71437c0aa834d198c147dfee2804031e03492dd955b7c7dd003b3205713f9fb

  • Size

    171KB

  • Sample

    241230-f1axdsyraw

  • MD5

    d517d5c14cf7cecc6ffd25be13d57410

  • SHA1

    04147c89852130384d2f8cef132b153d315f0170

  • SHA256

    a71437c0aa834d198c147dfee2804031e03492dd955b7c7dd003b3205713f9fb

  • SHA512

    677e1fa294974a1dd331c7f2a2af9175bc2fd0c83852023b1fffb869058bf790495a3cdbd07cd20809bcf234a21c2e6b54099efcabd39562012ff3754076e66b

  • SSDEEP

    3072:Qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:QH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_a71437c0aa834d198c147dfee2804031e03492dd955b7c7dd003b3205713f9fb

    • Size

      171KB

    • MD5

      d517d5c14cf7cecc6ffd25be13d57410

    • SHA1

      04147c89852130384d2f8cef132b153d315f0170

    • SHA256

      a71437c0aa834d198c147dfee2804031e03492dd955b7c7dd003b3205713f9fb

    • SHA512

      677e1fa294974a1dd331c7f2a2af9175bc2fd0c83852023b1fffb869058bf790495a3cdbd07cd20809bcf234a21c2e6b54099efcabd39562012ff3754076e66b

    • SSDEEP

      3072:Qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:QH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks