General

  • Target

    JaffaCakes118_6ea9d3d7f2de1b45f47945d0878531ef3e1306c77dc5eba79ebb17e31d9bef21

  • Size

    188KB

  • Sample

    241230-yx8y5azjds

  • MD5

    42c8e622727f895d6a9562717af85efa

  • SHA1

    bbdd67ead01336ddb729960382c40741755c6b5b

  • SHA256

    6ea9d3d7f2de1b45f47945d0878531ef3e1306c77dc5eba79ebb17e31d9bef21

  • SHA512

    68f073bc826d5fc3c78478a0d1140c8066e40ca61e6eaf7934e9f635296ff3cc94aa0cea5f74ab67e196648c7a1377b09748d32eda5a5dff27c6f4edf9652020

  • SSDEEP

    3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz09qM:Xq7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_6ea9d3d7f2de1b45f47945d0878531ef3e1306c77dc5eba79ebb17e31d9bef21

    • Size

      188KB

    • MD5

      42c8e622727f895d6a9562717af85efa

    • SHA1

      bbdd67ead01336ddb729960382c40741755c6b5b

    • SHA256

      6ea9d3d7f2de1b45f47945d0878531ef3e1306c77dc5eba79ebb17e31d9bef21

    • SHA512

      68f073bc826d5fc3c78478a0d1140c8066e40ca61e6eaf7934e9f635296ff3cc94aa0cea5f74ab67e196648c7a1377b09748d32eda5a5dff27c6f4edf9652020

    • SSDEEP

      3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz09qM:Xq7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks