General

  • Target

    JaffaCakes118_da2fe685dc01ef2ac32b06f080e1eb541b412056455d63b87ecd7a2e9cd77496

  • Size

    158KB

  • Sample

    241230-yv62rayrcw

  • MD5

    6736935b510b8c1c11fbf72d02d37c9b

  • SHA1

    5f87686e64a3f8c694987482d6d9374bd1205b13

  • SHA256

    da2fe685dc01ef2ac32b06f080e1eb541b412056455d63b87ecd7a2e9cd77496

  • SHA512

    52178e0b5fb1930d31f51edea56515b378dc8be3ffe99d4b2685b73acc67b1f3bfd766e95a9756a298ed4174dff88f34720c9ccb8838dc9c1ce7058584f66ecf

  • SSDEEP

    3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_da2fe685dc01ef2ac32b06f080e1eb541b412056455d63b87ecd7a2e9cd77496

    • Size

      158KB

    • MD5

      6736935b510b8c1c11fbf72d02d37c9b

    • SHA1

      5f87686e64a3f8c694987482d6d9374bd1205b13

    • SHA256

      da2fe685dc01ef2ac32b06f080e1eb541b412056455d63b87ecd7a2e9cd77496

    • SHA512

      52178e0b5fb1930d31f51edea56515b378dc8be3ffe99d4b2685b73acc67b1f3bfd766e95a9756a298ed4174dff88f34720c9ccb8838dc9c1ce7058584f66ecf

    • SSDEEP

      3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks