General

  • Target

    JaffaCakes118_f6baf178d4d9f3b21833d694fc367fde60b4ea7ae8c2f71caf56cc913008c4e9

  • Size

    188KB

  • Sample

    241230-gvb3yazrbw

  • MD5

    be34a1c35787cb7f0ecb3bc2c0b5e13d

  • SHA1

    19af9149c8bb1b780acc5771376b93fe62d0a8e4

  • SHA256

    f6baf178d4d9f3b21833d694fc367fde60b4ea7ae8c2f71caf56cc913008c4e9

  • SHA512

    0481227f5e7e1d9efe3dad59091a659e1476bb7629a0649cd052a65365b7d268b045dea334876f82725c10d87a9379583b27fa7ca02817dd2c64e673a4a62f63

  • SSDEEP

    3072:ateMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzS9qM:Sq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_f6baf178d4d9f3b21833d694fc367fde60b4ea7ae8c2f71caf56cc913008c4e9

    • Size

      188KB

    • MD5

      be34a1c35787cb7f0ecb3bc2c0b5e13d

    • SHA1

      19af9149c8bb1b780acc5771376b93fe62d0a8e4

    • SHA256

      f6baf178d4d9f3b21833d694fc367fde60b4ea7ae8c2f71caf56cc913008c4e9

    • SHA512

      0481227f5e7e1d9efe3dad59091a659e1476bb7629a0649cd052a65365b7d268b045dea334876f82725c10d87a9379583b27fa7ca02817dd2c64e673a4a62f63

    • SSDEEP

      3072:ateMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzS9qM:Sq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks