General

  • Target

    JaffaCakes118_dbb0976759430c593d2639b4da2ff52e3197538034c286af12ca2977a8bba2d8

  • Size

    172KB

  • Sample

    241230-yzcnpswrbk

  • MD5

    b3f6942c51677bfe6fe91538ea29a21d

  • SHA1

    89b75e88e516b73f584ca179fc3ae8ef3f89726b

  • SHA256

    dbb0976759430c593d2639b4da2ff52e3197538034c286af12ca2977a8bba2d8

  • SHA512

    bae224b1c852e9df88347494f1b63a8555cd6c45518d9b647c6a5b2d8affdded01bbc0ade86f538196563ede9988adf0523228372cad227650021a04a0a28019

  • SSDEEP

    3072:wWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:wWpY/S8Z83VewfR2GyxVcA5hvjRCmikG

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_dbb0976759430c593d2639b4da2ff52e3197538034c286af12ca2977a8bba2d8

    • Size

      172KB

    • MD5

      b3f6942c51677bfe6fe91538ea29a21d

    • SHA1

      89b75e88e516b73f584ca179fc3ae8ef3f89726b

    • SHA256

      dbb0976759430c593d2639b4da2ff52e3197538034c286af12ca2977a8bba2d8

    • SHA512

      bae224b1c852e9df88347494f1b63a8555cd6c45518d9b647c6a5b2d8affdded01bbc0ade86f538196563ede9988adf0523228372cad227650021a04a0a28019

    • SSDEEP

      3072:wWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:wWpY/S8Z83VewfR2GyxVcA5hvjRCmikG

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks