General

  • Target

    JaffaCakes118_b833d2b04ffddc6e657b8887c52969abe182b473e43dad41a483e59ea03a58da

  • Size

    170KB

  • Sample

    241230-zbmdnsxmfl

  • MD5

    35e29de62e6f6e5a2097b21a41014d18

  • SHA1

    393a69a6b293044ff59e5dff5fe61431be7e4fc6

  • SHA256

    b833d2b04ffddc6e657b8887c52969abe182b473e43dad41a483e59ea03a58da

  • SHA512

    66da3f87d114f3f92edcf1ab1166f29a8280042e75193c1f3abaddea169215bad67acc25eb35de8180e4effe47bef6175352f20aa0771f235c1d163084fb8473

  • SSDEEP

    3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_b833d2b04ffddc6e657b8887c52969abe182b473e43dad41a483e59ea03a58da

    • Size

      170KB

    • MD5

      35e29de62e6f6e5a2097b21a41014d18

    • SHA1

      393a69a6b293044ff59e5dff5fe61431be7e4fc6

    • SHA256

      b833d2b04ffddc6e657b8887c52969abe182b473e43dad41a483e59ea03a58da

    • SHA512

      66da3f87d114f3f92edcf1ab1166f29a8280042e75193c1f3abaddea169215bad67acc25eb35de8180e4effe47bef6175352f20aa0771f235c1d163084fb8473

    • SSDEEP

      3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks