General

  • Target

    JaffaCakes118_5442960127c1c76e6de6bf0a9c8c44241703aef8f66263ca2d01dde9f827b1eb

  • Size

    177KB

  • Sample

    241230-gsgweazqgx

  • MD5

    4ba8543c7e8365ce0da98905cbaea733

  • SHA1

    14de575ea092d334d3d7cad7c8e2dd274fa834ac

  • SHA256

    5442960127c1c76e6de6bf0a9c8c44241703aef8f66263ca2d01dde9f827b1eb

  • SHA512

    2754a55231ebffa2de20a0aae648adb7d392c7e90e59812d373a3429f49a6fcfd1fecf57284b7ffc6da1bf88b13df63990014df4006a093d1eae6dc1075d8654

  • SSDEEP

    3072:QuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:8zWxkOP4p2EesvcDi6DOHPJ

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.76.1.150:443

50.249.212.98:23399

104.168.154.79:5007

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_5442960127c1c76e6de6bf0a9c8c44241703aef8f66263ca2d01dde9f827b1eb

    • Size

      177KB

    • MD5

      4ba8543c7e8365ce0da98905cbaea733

    • SHA1

      14de575ea092d334d3d7cad7c8e2dd274fa834ac

    • SHA256

      5442960127c1c76e6de6bf0a9c8c44241703aef8f66263ca2d01dde9f827b1eb

    • SHA512

      2754a55231ebffa2de20a0aae648adb7d392c7e90e59812d373a3429f49a6fcfd1fecf57284b7ffc6da1bf88b13df63990014df4006a093d1eae6dc1075d8654

    • SSDEEP

      3072:QuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:8zWxkOP4p2EesvcDi6DOHPJ

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks