General

  • Target

    JaffaCakes118_a9631666487c6bc95802e5de807b0d7e9a4a4fe8302c9f12452a6fc06cca0cad

  • Size

    177KB

  • Sample

    241230-z5crbsyqal

  • MD5

    da2d6f29530cd7fa0f0707e36869aa20

  • SHA1

    c71d0b403e432fb07187fcc000382dd9f9f6cea1

  • SHA256

    a9631666487c6bc95802e5de807b0d7e9a4a4fe8302c9f12452a6fc06cca0cad

  • SHA512

    a3bdfafe19d9d78ebff5c9932d22212b1b9d162dbcad8288c9c5cbb205d6a0c1fbd060fa52b65c4d15b119be289f89a56c2cb4b027fae5cd5764c5d85b55e88b

  • SSDEEP

    3072:XuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:TzWxkOP4p2EesvcDi6DOHPJ

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.76.1.150:443

50.249.212.98:23399

104.168.154.79:5007

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_a9631666487c6bc95802e5de807b0d7e9a4a4fe8302c9f12452a6fc06cca0cad

    • Size

      177KB

    • MD5

      da2d6f29530cd7fa0f0707e36869aa20

    • SHA1

      c71d0b403e432fb07187fcc000382dd9f9f6cea1

    • SHA256

      a9631666487c6bc95802e5de807b0d7e9a4a4fe8302c9f12452a6fc06cca0cad

    • SHA512

      a3bdfafe19d9d78ebff5c9932d22212b1b9d162dbcad8288c9c5cbb205d6a0c1fbd060fa52b65c4d15b119be289f89a56c2cb4b027fae5cd5764c5d85b55e88b

    • SSDEEP

      3072:XuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:TzWxkOP4p2EesvcDi6DOHPJ

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks