General

  • Target

    JaffaCakes118_e66fdace3e0ecd4663dbcd47e2976f13c1a4477153513b72bbb24f489c96ff53

  • Size

    171KB

  • Sample

    241230-xz1vvsxlcx

  • MD5

    bd62fcbdfbb722fc1e1f8a6b478917e9

  • SHA1

    cda2e5b61a4444fe450e13ca71a6562cbb33ed49

  • SHA256

    e66fdace3e0ecd4663dbcd47e2976f13c1a4477153513b72bbb24f489c96ff53

  • SHA512

    74cb192ffe7af86718bbaee60c0c69fbb7182bf265aa1f64e104e98da6a71b3d9b9af72511904749cb3d5bb09a762268e8c7d08a28dff8f18f7c852d5d0d9c08

  • SSDEEP

    3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_e66fdace3e0ecd4663dbcd47e2976f13c1a4477153513b72bbb24f489c96ff53

    • Size

      171KB

    • MD5

      bd62fcbdfbb722fc1e1f8a6b478917e9

    • SHA1

      cda2e5b61a4444fe450e13ca71a6562cbb33ed49

    • SHA256

      e66fdace3e0ecd4663dbcd47e2976f13c1a4477153513b72bbb24f489c96ff53

    • SHA512

      74cb192ffe7af86718bbaee60c0c69fbb7182bf265aa1f64e104e98da6a71b3d9b9af72511904749cb3d5bb09a762268e8c7d08a28dff8f18f7c852d5d0d9c08

    • SSDEEP

      3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks