General

  • Target

    JaffaCakes118_3c1e99fb3de5eb0d4cb35726e70b88987049625c45df4960544c3e6ca116ba24

  • Size

    188KB

  • Sample

    241230-gl9b3szpgy

  • MD5

    2bbdfa36ddbc3b5d5e3d5f3527a0944a

  • SHA1

    6c444e8ba0608373ee504eaf83d5f54f8cf61257

  • SHA256

    3c1e99fb3de5eb0d4cb35726e70b88987049625c45df4960544c3e6ca116ba24

  • SHA512

    2aeabd338befa96523b09b9e6a2b84c48221807a3f99fb8f7edb824adf48039e1940ad2bd02d3888b798134386d7c55f2bddee03a459442050603ddae7e7327c

  • SSDEEP

    3072:hteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzB9qM:tq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_3c1e99fb3de5eb0d4cb35726e70b88987049625c45df4960544c3e6ca116ba24

    • Size

      188KB

    • MD5

      2bbdfa36ddbc3b5d5e3d5f3527a0944a

    • SHA1

      6c444e8ba0608373ee504eaf83d5f54f8cf61257

    • SHA256

      3c1e99fb3de5eb0d4cb35726e70b88987049625c45df4960544c3e6ca116ba24

    • SHA512

      2aeabd338befa96523b09b9e6a2b84c48221807a3f99fb8f7edb824adf48039e1940ad2bd02d3888b798134386d7c55f2bddee03a459442050603ddae7e7327c

    • SSDEEP

      3072:hteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzB9qM:tq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks