General

  • Target

    JaffaCakes118_1d066c14a4b2e74ca6f07f38dbbe2def893296254566e14da5d0341e014ee94a

  • Size

    170KB

  • Sample

    241230-v8wama1pam

  • MD5

    fc2445911675abf1b49dafb701475448

  • SHA1

    1204a0463a880279ecb4d1f9b4d8642b05e92756

  • SHA256

    1d066c14a4b2e74ca6f07f38dbbe2def893296254566e14da5d0341e014ee94a

  • SHA512

    5e0dc6553984bda9c51b2e781f9d873a981378fb760c0e25eb6606b1b80b9cf8a345705e0ef02bc8e06c503fa70e70555e2b27bcf9e24bffccdc3dbb7592dce2

  • SSDEEP

    3072:jqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:tVqNd+CIQHXu9VFmu0qU2CJ5

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_1d066c14a4b2e74ca6f07f38dbbe2def893296254566e14da5d0341e014ee94a

    • Size

      170KB

    • MD5

      fc2445911675abf1b49dafb701475448

    • SHA1

      1204a0463a880279ecb4d1f9b4d8642b05e92756

    • SHA256

      1d066c14a4b2e74ca6f07f38dbbe2def893296254566e14da5d0341e014ee94a

    • SHA512

      5e0dc6553984bda9c51b2e781f9d873a981378fb760c0e25eb6606b1b80b9cf8a345705e0ef02bc8e06c503fa70e70555e2b27bcf9e24bffccdc3dbb7592dce2

    • SSDEEP

      3072:jqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:tVqNd+CIQHXu9VFmu0qU2CJ5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks