General

  • Target

    JaffaCakes118_3de849de4048d14546dbc52e0954a27c1447bd1ce24739ab1a39f7f914bde552

  • Size

    184KB

  • Sample

    241230-xxke4axkbs

  • MD5

    61aa6f35d7c0adfebfa7d84874b51674

  • SHA1

    7b0a089323fc4624e0b7aac8fae0dc1b750ab2b1

  • SHA256

    3de849de4048d14546dbc52e0954a27c1447bd1ce24739ab1a39f7f914bde552

  • SHA512

    427d6450ba3ebe6c812f20f480f8891fca7f0fe2b48a7d8902ce4be4c0d96d4086333de6c43d04ceb101f0af42fd2b5f4c1ec419b9625d3a69f6be1827659631

  • SSDEEP

    3072:v92qSmHOhnWpPI1ybmJIiC00PArIojHTYVBCn+rs3Ss3qLMTTrLA:v9NSMOEpQ1Q3ODAr+Vj

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_3de849de4048d14546dbc52e0954a27c1447bd1ce24739ab1a39f7f914bde552

    • Size

      184KB

    • MD5

      61aa6f35d7c0adfebfa7d84874b51674

    • SHA1

      7b0a089323fc4624e0b7aac8fae0dc1b750ab2b1

    • SHA256

      3de849de4048d14546dbc52e0954a27c1447bd1ce24739ab1a39f7f914bde552

    • SHA512

      427d6450ba3ebe6c812f20f480f8891fca7f0fe2b48a7d8902ce4be4c0d96d4086333de6c43d04ceb101f0af42fd2b5f4c1ec419b9625d3a69f6be1827659631

    • SSDEEP

      3072:v92qSmHOhnWpPI1ybmJIiC00PArIojHTYVBCn+rs3Ss3qLMTTrLA:v9NSMOEpQ1Q3ODAr+Vj

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks