General

  • Target

    JaffaCakes118_ba6b08a88603e3c704db81113857d51fc1a95b3f64266a4a97047d1b2dbe634c

  • Size

    188KB

  • Sample

    241230-fgw1hsymhn

  • MD5

    18ff304afe5a026eb7ce390ef586fbc9

  • SHA1

    7ce2e4e6fd8eb1a5b2e89315ef112c547883b325

  • SHA256

    ba6b08a88603e3c704db81113857d51fc1a95b3f64266a4a97047d1b2dbe634c

  • SHA512

    41a688f89b776b4272976ef9825b7e430690687584f35e578adc3de74c23aa2d9e0dadfc4549bc99355ee7bf38f4ec165b91072df09081939ba5aae5a9c135b2

  • SSDEEP

    3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:Eq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_ba6b08a88603e3c704db81113857d51fc1a95b3f64266a4a97047d1b2dbe634c

    • Size

      188KB

    • MD5

      18ff304afe5a026eb7ce390ef586fbc9

    • SHA1

      7ce2e4e6fd8eb1a5b2e89315ef112c547883b325

    • SHA256

      ba6b08a88603e3c704db81113857d51fc1a95b3f64266a4a97047d1b2dbe634c

    • SHA512

      41a688f89b776b4272976ef9825b7e430690687584f35e578adc3de74c23aa2d9e0dadfc4549bc99355ee7bf38f4ec165b91072df09081939ba5aae5a9c135b2

    • SSDEEP

      3072:QteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzI9qM:Eq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks