General

  • Target

    JaffaCakes118_fea0dafd445a2dd22a86ae9543cf8d028c8c27323a5ba0af55314e77af998754

  • Size

    188KB

  • Sample

    241230-gkfclszpcy

  • MD5

    ef6b08e2be3520cdf85db0aee8f9ba4d

  • SHA1

    289e18bc7180bfc4a030e6d433165356b7bd487e

  • SHA256

    fea0dafd445a2dd22a86ae9543cf8d028c8c27323a5ba0af55314e77af998754

  • SHA512

    31ba6c72599b68dafa50988ae2654966876c0003b0595babd8d80f3d9c0d1f9fe4aff823ae7c0f3a2180cf14efad5aa0c010c7bcae7d26f2b628b1bd83cbc050

  • SSDEEP

    3072:8teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzq9qM:Aq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_fea0dafd445a2dd22a86ae9543cf8d028c8c27323a5ba0af55314e77af998754

    • Size

      188KB

    • MD5

      ef6b08e2be3520cdf85db0aee8f9ba4d

    • SHA1

      289e18bc7180bfc4a030e6d433165356b7bd487e

    • SHA256

      fea0dafd445a2dd22a86ae9543cf8d028c8c27323a5ba0af55314e77af998754

    • SHA512

      31ba6c72599b68dafa50988ae2654966876c0003b0595babd8d80f3d9c0d1f9fe4aff823ae7c0f3a2180cf14efad5aa0c010c7bcae7d26f2b628b1bd83cbc050

    • SSDEEP

      3072:8teMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzq9qM:Aq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks