General

  • Target

    JaffaCakes118_8eaa294e9644f7634417775c5b3f22d9dec463f2a9a2d3625ae6cbaf76cdab75

  • Size

    170KB

  • Sample

    241230-x91b3sxqav

  • MD5

    552ba607e504e99acf605e621ca0bb29

  • SHA1

    6a384e711b022699d0ade0eec28cdfefb1f0603b

  • SHA256

    8eaa294e9644f7634417775c5b3f22d9dec463f2a9a2d3625ae6cbaf76cdab75

  • SHA512

    f9866a58da2d2bff494181d49222caa37c3179b65a89ed0a276d46eaaf2d30d24e2463ef5a874f103f695612378959c61e18f21989ac83e78a823868a69cd5a9

  • SSDEEP

    3072:yqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:0VqNd+CIQHXu9VFmu0qU2CJ5

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_8eaa294e9644f7634417775c5b3f22d9dec463f2a9a2d3625ae6cbaf76cdab75

    • Size

      170KB

    • MD5

      552ba607e504e99acf605e621ca0bb29

    • SHA1

      6a384e711b022699d0ade0eec28cdfefb1f0603b

    • SHA256

      8eaa294e9644f7634417775c5b3f22d9dec463f2a9a2d3625ae6cbaf76cdab75

    • SHA512

      f9866a58da2d2bff494181d49222caa37c3179b65a89ed0a276d46eaaf2d30d24e2463ef5a874f103f695612378959c61e18f21989ac83e78a823868a69cd5a9

    • SSDEEP

      3072:yqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:0VqNd+CIQHXu9VFmu0qU2CJ5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks