General

  • Target

    JaffaCakes118_facdb080f97deacf6d7c01c08e3173a1840b313cac7594c86fe83409ae4ca7b7

  • Size

    173KB

  • Sample

    241230-wl2pkaskbk

  • MD5

    4ab58143ff93882c3f331bed5ec9bf91

  • SHA1

    2dfbde27206e26a85c02589643aab0366ba1d08e

  • SHA256

    facdb080f97deacf6d7c01c08e3173a1840b313cac7594c86fe83409ae4ca7b7

  • SHA512

    3fcdecf0a8f2b5b3b59f0489880cbe4ec2d3d5b428df46f25f4ada954c1ae6b2e92ee90f6e473949e19551e2d5d5085595ee1b714a50f9646b8f24497b987ffd

  • SSDEEP

    3072:RaI6YY/DDdmhdj+O2WYXwU3qstRty89ksDAqOim1Gz4:RazYY/HO1kPdy8ksDn1mY

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

159.69.237.186:443

207.210.192.60:8172

51.77.82.110:9987

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_facdb080f97deacf6d7c01c08e3173a1840b313cac7594c86fe83409ae4ca7b7

    • Size

      173KB

    • MD5

      4ab58143ff93882c3f331bed5ec9bf91

    • SHA1

      2dfbde27206e26a85c02589643aab0366ba1d08e

    • SHA256

      facdb080f97deacf6d7c01c08e3173a1840b313cac7594c86fe83409ae4ca7b7

    • SHA512

      3fcdecf0a8f2b5b3b59f0489880cbe4ec2d3d5b428df46f25f4ada954c1ae6b2e92ee90f6e473949e19551e2d5d5085595ee1b714a50f9646b8f24497b987ffd

    • SSDEEP

      3072:RaI6YY/DDdmhdj+O2WYXwU3qstRty89ksDAqOim1Gz4:RazYY/HO1kPdy8ksDn1mY

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks