General

  • Target

    JaffaCakes118_cfcc2168770319dd407d9f4d99c0d06c005176e2877f3842591e4c0f61cb754f

  • Size

    171KB

  • Sample

    241230-xefdestlbq

  • MD5

    4a0654752665d463e91e495550ab570b

  • SHA1

    2b77d62a2ea96f72d85100c9a63d31a6ca6a3f5d

  • SHA256

    cfcc2168770319dd407d9f4d99c0d06c005176e2877f3842591e4c0f61cb754f

  • SHA512

    201f3b731692691d66de2ab03f4a1ebe58a82c509ff4c1531b7358a1665e71cc9719a28131a302e0aa27522ce903c96be1cf2831975e238ccd7a97c894e738bc

  • SSDEEP

    3072:bi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:bH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_cfcc2168770319dd407d9f4d99c0d06c005176e2877f3842591e4c0f61cb754f

    • Size

      171KB

    • MD5

      4a0654752665d463e91e495550ab570b

    • SHA1

      2b77d62a2ea96f72d85100c9a63d31a6ca6a3f5d

    • SHA256

      cfcc2168770319dd407d9f4d99c0d06c005176e2877f3842591e4c0f61cb754f

    • SHA512

      201f3b731692691d66de2ab03f4a1ebe58a82c509ff4c1531b7358a1665e71cc9719a28131a302e0aa27522ce903c96be1cf2831975e238ccd7a97c894e738bc

    • SSDEEP

      3072:bi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:bH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks