General

  • Target

    JaffaCakes118_5deea7b90a8150da316d3fd78f3551c7bbfef49f14628efb53af1bd75e9c9259

  • Size

    178KB

  • Sample

    241230-xb9svswkh1

  • MD5

    22da329e2daf80653e6fe1dd6b349950

  • SHA1

    81646dcd24b76ac167a7dc8c3bcd8ae322109b63

  • SHA256

    5deea7b90a8150da316d3fd78f3551c7bbfef49f14628efb53af1bd75e9c9259

  • SHA512

    ef57aa7463f1798137361f73c0f6aa30b6a1937e903c199efca4878434666de4cd1f1859ee3129ebb9dd29a09b289c05f415b4765832863af697473b3a4a8f0d

  • SSDEEP

    3072:iZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtuUucGZ2:iUAk9I4vgz/V2dulz6/hvHhG

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

142.93.223.149:443

128.199.36.62:4664

50.116.54.215:13786

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_5deea7b90a8150da316d3fd78f3551c7bbfef49f14628efb53af1bd75e9c9259

    • Size

      178KB

    • MD5

      22da329e2daf80653e6fe1dd6b349950

    • SHA1

      81646dcd24b76ac167a7dc8c3bcd8ae322109b63

    • SHA256

      5deea7b90a8150da316d3fd78f3551c7bbfef49f14628efb53af1bd75e9c9259

    • SHA512

      ef57aa7463f1798137361f73c0f6aa30b6a1937e903c199efca4878434666de4cd1f1859ee3129ebb9dd29a09b289c05f415b4765832863af697473b3a4a8f0d

    • SSDEEP

      3072:iZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtuUucGZ2:iUAk9I4vgz/V2dulz6/hvHhG

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks