General

  • Target

    JaffaCakes118_540767ef68818da790634b7aae476f45f794a879eef87c486c8aa2099c829201

  • Size

    170KB

  • Sample

    241230-gl7s9azpel

  • MD5

    f84ea9293c2c245d34de5ab0058ac753

  • SHA1

    77f6b74861afb11262987bbeb009d860f7c035c3

  • SHA256

    540767ef68818da790634b7aae476f45f794a879eef87c486c8aa2099c829201

  • SHA512

    2d1237c3d9aac84014bdfa076287db0c3820a7751a65f446dd4bc8f435f5dcd5abfe7b455b137882f23b6b56414f66ce22b81adf8e9a33072d37e4498c6102ce

  • SSDEEP

    3072:PqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:pVqNd+CIQHXu9VFmu0qU2CJ5

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_540767ef68818da790634b7aae476f45f794a879eef87c486c8aa2099c829201

    • Size

      170KB

    • MD5

      f84ea9293c2c245d34de5ab0058ac753

    • SHA1

      77f6b74861afb11262987bbeb009d860f7c035c3

    • SHA256

      540767ef68818da790634b7aae476f45f794a879eef87c486c8aa2099c829201

    • SHA512

      2d1237c3d9aac84014bdfa076287db0c3820a7751a65f446dd4bc8f435f5dcd5abfe7b455b137882f23b6b56414f66ce22b81adf8e9a33072d37e4498c6102ce

    • SSDEEP

      3072:PqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:pVqNd+CIQHXu9VFmu0qU2CJ5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks