General

  • Target

    JaffaCakes118_a468643b6d8f80ffc83b61bc21460562fc0ffb08a23507abfa77e2ff7e0c8f6d

  • Size

    188KB

  • Sample

    241230-zgd99azrat

  • MD5

    ba7ee919c6757ca8dac6e3f46f5e88da

  • SHA1

    28af29c37498c0b01f6854b86d0c9f7ceb8251ca

  • SHA256

    a468643b6d8f80ffc83b61bc21460562fc0ffb08a23507abfa77e2ff7e0c8f6d

  • SHA512

    8376037e2310fec32746ee25c4b28038411f18bf43c8e53f2a09f7d32167ad746522adf362b3bef68b83f9e71207c45b50de3dc5555f234933fa2f370db90fa0

  • SSDEEP

    3072:zteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz09qM:7q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_a468643b6d8f80ffc83b61bc21460562fc0ffb08a23507abfa77e2ff7e0c8f6d

    • Size

      188KB

    • MD5

      ba7ee919c6757ca8dac6e3f46f5e88da

    • SHA1

      28af29c37498c0b01f6854b86d0c9f7ceb8251ca

    • SHA256

      a468643b6d8f80ffc83b61bc21460562fc0ffb08a23507abfa77e2ff7e0c8f6d

    • SHA512

      8376037e2310fec32746ee25c4b28038411f18bf43c8e53f2a09f7d32167ad746522adf362b3bef68b83f9e71207c45b50de3dc5555f234933fa2f370db90fa0

    • SSDEEP

      3072:zteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz09qM:7q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks