General

  • Target

    JaffaCakes118_fe56ea82fcf9823dcacaf4debec78312dbc699fb0f9aa8924c40e64cdc3d6bf8

  • Size

    172KB

  • Sample

    241230-gl6k7azpek

  • MD5

    bb8978ae6240e2b5a8f5651593faaa3d

  • SHA1

    6a035a72a202ca3ccb73554479dd6a083a0c64dd

  • SHA256

    fe56ea82fcf9823dcacaf4debec78312dbc699fb0f9aa8924c40e64cdc3d6bf8

  • SHA512

    643408f365b5882ab2750b0e4abc3dbd95b6f2f7251ac7ff248f32c04f1db215822625dab74e2836a26d83cc690a0b3613dfb3e2fdb1997329a6a751c15a352f

  • SSDEEP

    3072:2WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:2WpY/S8Z83VewfR2GyxVcA5hvjRCmikG

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_fe56ea82fcf9823dcacaf4debec78312dbc699fb0f9aa8924c40e64cdc3d6bf8

    • Size

      172KB

    • MD5

      bb8978ae6240e2b5a8f5651593faaa3d

    • SHA1

      6a035a72a202ca3ccb73554479dd6a083a0c64dd

    • SHA256

      fe56ea82fcf9823dcacaf4debec78312dbc699fb0f9aa8924c40e64cdc3d6bf8

    • SHA512

      643408f365b5882ab2750b0e4abc3dbd95b6f2f7251ac7ff248f32c04f1db215822625dab74e2836a26d83cc690a0b3613dfb3e2fdb1997329a6a751c15a352f

    • SSDEEP

      3072:2WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:2WpY/S8Z83VewfR2GyxVcA5hvjRCmikG

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks