General

  • Target

    JaffaCakes118_f710f7d9be09c5f68adecac5610b36fd74b88316909e36d34d16406c40d97938

  • Size

    162KB

  • Sample

    241230-yfc55avrfk

  • MD5

    08effbf20d61cb6adf38ee803ab51da3

  • SHA1

    9fe85b6b854bb2f02f4ef88d3e17d904e4d72028

  • SHA256

    f710f7d9be09c5f68adecac5610b36fd74b88316909e36d34d16406c40d97938

  • SHA512

    043f5ad97e4a08e91e25a3cd13051297a5af3d860d26a10ffac531148c464a5a2ca9940f8b3607025fa04d593ab8de1ba4803697403749ec71ca4243ae3add56

  • SSDEEP

    3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_f710f7d9be09c5f68adecac5610b36fd74b88316909e36d34d16406c40d97938

    • Size

      162KB

    • MD5

      08effbf20d61cb6adf38ee803ab51da3

    • SHA1

      9fe85b6b854bb2f02f4ef88d3e17d904e4d72028

    • SHA256

      f710f7d9be09c5f68adecac5610b36fd74b88316909e36d34d16406c40d97938

    • SHA512

      043f5ad97e4a08e91e25a3cd13051297a5af3d860d26a10ffac531148c464a5a2ca9940f8b3607025fa04d593ab8de1ba4803697403749ec71ca4243ae3add56

    • SSDEEP

      3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks