General

  • Target

    JaffaCakes118_25fd11d9fb4a9939175b536b201e029a6ef44e2bbeb9a3a9e6ac6fc8179b5098

  • Size

    170KB

  • Sample

    241230-yxkarszjas

  • MD5

    976eb802b386f9c7595c7f5f91bcb4ed

  • SHA1

    e1ab3783d7b755d46ee09b1a3bf9240cdcd75370

  • SHA256

    25fd11d9fb4a9939175b536b201e029a6ef44e2bbeb9a3a9e6ac6fc8179b5098

  • SHA512

    ed85ab80bb76feb37c82952aefe858dff3d6748885cf2f0681de94783c4e58732f38ef69442e1f4eb41de8a5c2f5bc7c2c3000fe6d895716d029a710fdecc1ab

  • SSDEEP

    3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_25fd11d9fb4a9939175b536b201e029a6ef44e2bbeb9a3a9e6ac6fc8179b5098

    • Size

      170KB

    • MD5

      976eb802b386f9c7595c7f5f91bcb4ed

    • SHA1

      e1ab3783d7b755d46ee09b1a3bf9240cdcd75370

    • SHA256

      25fd11d9fb4a9939175b536b201e029a6ef44e2bbeb9a3a9e6ac6fc8179b5098

    • SHA512

      ed85ab80bb76feb37c82952aefe858dff3d6748885cf2f0681de94783c4e58732f38ef69442e1f4eb41de8a5c2f5bc7c2c3000fe6d895716d029a710fdecc1ab

    • SSDEEP

      3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks