General

  • Target

    JaffaCakes118_9777afc13c1e539ea74effef6517419d4685b336d61828a0ecc2c1d012a668f3

  • Size

    188KB

  • Sample

    241230-gtms2szrax

  • MD5

    2b4206950421ffd789d9efc82f0d36b1

  • SHA1

    595fa270063d27bc6e6acd5825802cd7569d5810

  • SHA256

    9777afc13c1e539ea74effef6517419d4685b336d61828a0ecc2c1d012a668f3

  • SHA512

    39ae761d098f96ef5bf7a8718dda81e7c5ffaa0dea8b1a004a05468f131fc1bd196eebf8f601305a5dc9eed9b3b3a3f51c104c10cbc113a486897601a6c62300

  • SSDEEP

    3072:cteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzN9qM:gq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_9777afc13c1e539ea74effef6517419d4685b336d61828a0ecc2c1d012a668f3

    • Size

      188KB

    • MD5

      2b4206950421ffd789d9efc82f0d36b1

    • SHA1

      595fa270063d27bc6e6acd5825802cd7569d5810

    • SHA256

      9777afc13c1e539ea74effef6517419d4685b336d61828a0ecc2c1d012a668f3

    • SHA512

      39ae761d098f96ef5bf7a8718dda81e7c5ffaa0dea8b1a004a05468f131fc1bd196eebf8f601305a5dc9eed9b3b3a3f51c104c10cbc113a486897601a6c62300

    • SSDEEP

      3072:cteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzN9qM:gq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks