General

  • Target

    JaffaCakes118_99973d940e73c89808bcc31fed13124fc5ddc9c29233bdf6e3f061c4a0040c2a

  • Size

    171KB

  • Sample

    241230-g3r45a1jcm

  • MD5

    ce5df597659a7676c9d58e7fa18584f8

  • SHA1

    78c384bd0d31f3bb268f216aeb3aa4e6bac24bfb

  • SHA256

    99973d940e73c89808bcc31fed13124fc5ddc9c29233bdf6e3f061c4a0040c2a

  • SHA512

    77448762906235582c41541b4ea1a4ea5fb3e3b586a59272f11fc44a41c257287d7b17b54966a17e3cdb2ab350e03b7edc878f73469335f7f444a0ecdf1e6a5c

  • SSDEEP

    3072:Mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:MH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_99973d940e73c89808bcc31fed13124fc5ddc9c29233bdf6e3f061c4a0040c2a

    • Size

      171KB

    • MD5

      ce5df597659a7676c9d58e7fa18584f8

    • SHA1

      78c384bd0d31f3bb268f216aeb3aa4e6bac24bfb

    • SHA256

      99973d940e73c89808bcc31fed13124fc5ddc9c29233bdf6e3f061c4a0040c2a

    • SHA512

      77448762906235582c41541b4ea1a4ea5fb3e3b586a59272f11fc44a41c257287d7b17b54966a17e3cdb2ab350e03b7edc878f73469335f7f444a0ecdf1e6a5c

    • SSDEEP

      3072:Mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:MH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks