General

  • Target

    JaffaCakes118_8941fb3b53c57361881de9a7bbb70583e40141a6c31c40253a0ba3b8f30292ad

  • Size

    161KB

  • Sample

    241230-zgmlmazrbs

  • MD5

    54129669ed3ff9fdb4442838fcc57c12

  • SHA1

    d4d4804a3fd12abd0596c6c26d1cd8f6d8d2d926

  • SHA256

    8941fb3b53c57361881de9a7bbb70583e40141a6c31c40253a0ba3b8f30292ad

  • SHA512

    138b2b97ec91c18888401a8e2e42f5c378964c26c379857c6e291ec20a701eb278170c02cd892a339cb25ed8ae6411110d360f3b43113b685a21bd2e8037f6e0

  • SSDEEP

    3072:Lk2X+QFg3UutDvUvoU8pz6EJEEhu6Tzace9kuaGA81/YXKHML/Yp8AF:BG3rUvoU4JE/Wzan9T7B/CKsL/Yy

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_8941fb3b53c57361881de9a7bbb70583e40141a6c31c40253a0ba3b8f30292ad

    • Size

      161KB

    • MD5

      54129669ed3ff9fdb4442838fcc57c12

    • SHA1

      d4d4804a3fd12abd0596c6c26d1cd8f6d8d2d926

    • SHA256

      8941fb3b53c57361881de9a7bbb70583e40141a6c31c40253a0ba3b8f30292ad

    • SHA512

      138b2b97ec91c18888401a8e2e42f5c378964c26c379857c6e291ec20a701eb278170c02cd892a339cb25ed8ae6411110d360f3b43113b685a21bd2e8037f6e0

    • SSDEEP

      3072:Lk2X+QFg3UutDvUvoU8pz6EJEEhu6Tzace9kuaGA81/YXKHML/Yp8AF:BG3rUvoU4JE/Wzan9T7B/CKsL/Yy

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks