General

  • Target

    JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0

  • Size

    160KB

  • Sample

    241230-x74lqaxpby

  • MD5

    9a9da1facf1de719d644a336cd51eff3

  • SHA1

    5bb91a3f23fa37f283e375c38a1eb980f64e3f6c

  • SHA256

    850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0

  • SHA512

    30042d5a873f8de99b441263c2f4e05a9bd63bdabc1d5917e8b167d1076a2111404073a284b9bf8f719c39fca4c7f1acb31f43fde35425ad946c4e7de047a999

  • SSDEEP

    3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0

    • Size

      160KB

    • MD5

      9a9da1facf1de719d644a336cd51eff3

    • SHA1

      5bb91a3f23fa37f283e375c38a1eb980f64e3f6c

    • SHA256

      850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0

    • SHA512

      30042d5a873f8de99b441263c2f4e05a9bd63bdabc1d5917e8b167d1076a2111404073a284b9bf8f719c39fca4c7f1acb31f43fde35425ad946c4e7de047a999

    • SSDEEP

      3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks