General

  • Target

    JaffaCakes118_b9ee99b34592ac61ab6c6f5da9907c92d5c116c133a5d38f1ec0cddf5f065ff7

  • Size

    188KB

  • Sample

    241230-xf68jatlhq

  • MD5

    881ee554390c8916018379e91b8c16a4

  • SHA1

    a64547eca7f5128a887dec8ad83d7403dbe61947

  • SHA256

    b9ee99b34592ac61ab6c6f5da9907c92d5c116c133a5d38f1ec0cddf5f065ff7

  • SHA512

    96629c5125a96bebfb504dd5d21ea9337a0975d23e9fbe566d58057b24b4942c447be62b14625c1a2eaae71e9e8bddffc39b29de558e9a095d42d32842318de4

  • SSDEEP

    3072:bteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:zq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b9ee99b34592ac61ab6c6f5da9907c92d5c116c133a5d38f1ec0cddf5f065ff7

    • Size

      188KB

    • MD5

      881ee554390c8916018379e91b8c16a4

    • SHA1

      a64547eca7f5128a887dec8ad83d7403dbe61947

    • SHA256

      b9ee99b34592ac61ab6c6f5da9907c92d5c116c133a5d38f1ec0cddf5f065ff7

    • SHA512

      96629c5125a96bebfb504dd5d21ea9337a0975d23e9fbe566d58057b24b4942c447be62b14625c1a2eaae71e9e8bddffc39b29de558e9a095d42d32842318de4

    • SSDEEP

      3072:bteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzx9qM:zq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks