General

  • Target

    JaffaCakes118_bbe183f35f2c6029f23b02e786c84616c0ac1ccf70b33344b0d06a9179f8ffac

  • Size

    166KB

  • Sample

    241230-wn795askhn

  • MD5

    24f7846d5e6ddd2fa6b63f833dd2367d

  • SHA1

    eb4e13c3eca0ada5161c3e10796d37a30fa0a530

  • SHA256

    bbe183f35f2c6029f23b02e786c84616c0ac1ccf70b33344b0d06a9179f8ffac

  • SHA512

    60a4d3a2fb55f1a0e9c1710b00a872291aa165e21d3c23738ad48d7bd67ff59f1c64cdb574d58930cbc5515e9e1b63e055f208d5941a3b266482d9faf2a81b60

  • SSDEEP

    3072:/BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:puXLcclWEc2HeSjNjGdeD8

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

131.100.24.202:443

193.160.214.95:4125

67.43.4.76:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_bbe183f35f2c6029f23b02e786c84616c0ac1ccf70b33344b0d06a9179f8ffac

    • Size

      166KB

    • MD5

      24f7846d5e6ddd2fa6b63f833dd2367d

    • SHA1

      eb4e13c3eca0ada5161c3e10796d37a30fa0a530

    • SHA256

      bbe183f35f2c6029f23b02e786c84616c0ac1ccf70b33344b0d06a9179f8ffac

    • SHA512

      60a4d3a2fb55f1a0e9c1710b00a872291aa165e21d3c23738ad48d7bd67ff59f1c64cdb574d58930cbc5515e9e1b63e055f208d5941a3b266482d9faf2a81b60

    • SSDEEP

      3072:/BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:puXLcclWEc2HeSjNjGdeD8

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks