General

  • Target

    JaffaCakes118_b054bbf1c4c3e04bf918c855474ab988ce6dcd20c347729ef9ed7f6c9a280624

  • Size

    161KB

  • Sample

    241230-xgpd4stmbp

  • MD5

    a9e3eada2657bece87ab78e23d4f8415

  • SHA1

    aa40f1a83e9e4dd8d94f1d186c9b526642e8d152

  • SHA256

    b054bbf1c4c3e04bf918c855474ab988ce6dcd20c347729ef9ed7f6c9a280624

  • SHA512

    10819545018c21ee143bbbe30e643907141c39c2608e81ea48a33f7b45ba59433a3445904e0fc5398384dd455df3506a85fbc3ac74f42fd73f8c25453841d33a

  • SSDEEP

    3072:LH63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUHCx3:La/jkvhSlP/7bg8aFnA3brp

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b054bbf1c4c3e04bf918c855474ab988ce6dcd20c347729ef9ed7f6c9a280624

    • Size

      161KB

    • MD5

      a9e3eada2657bece87ab78e23d4f8415

    • SHA1

      aa40f1a83e9e4dd8d94f1d186c9b526642e8d152

    • SHA256

      b054bbf1c4c3e04bf918c855474ab988ce6dcd20c347729ef9ed7f6c9a280624

    • SHA512

      10819545018c21ee143bbbe30e643907141c39c2608e81ea48a33f7b45ba59433a3445904e0fc5398384dd455df3506a85fbc3ac74f42fd73f8c25453841d33a

    • SSDEEP

      3072:LH63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUHCx3:La/jkvhSlP/7bg8aFnA3brp

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks