General

  • Target

    JaffaCakes118_846d6ec62764785f5b2032c2a6d39e82baa161263ec22e2e6b037ee4b2e22bf1

  • Size

    188KB

  • Sample

    241230-zkbcrsxqhl

  • MD5

    61f7a2686d096ec92ba3cdcaff221760

  • SHA1

    4f548d23df926ee29134998caf06d78afab17a7a

  • SHA256

    846d6ec62764785f5b2032c2a6d39e82baa161263ec22e2e6b037ee4b2e22bf1

  • SHA512

    c54892fc8dbe6165201f7ed2c19e58e1817e1ff1a99780c8c487e5fab18ab04043377214c7532e16eddf3510725d2e92e422f54962a3efba17afcb2893e2e9c6

  • SSDEEP

    3072:gteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzC9qM:0q7fYIHBZkTB6DWruUCOwjt

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.87.173.60:443

45.32.243.209:8116

207.180.208.54:4664

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_846d6ec62764785f5b2032c2a6d39e82baa161263ec22e2e6b037ee4b2e22bf1

    • Size

      188KB

    • MD5

      61f7a2686d096ec92ba3cdcaff221760

    • SHA1

      4f548d23df926ee29134998caf06d78afab17a7a

    • SHA256

      846d6ec62764785f5b2032c2a6d39e82baa161263ec22e2e6b037ee4b2e22bf1

    • SHA512

      c54892fc8dbe6165201f7ed2c19e58e1817e1ff1a99780c8c487e5fab18ab04043377214c7532e16eddf3510725d2e92e422f54962a3efba17afcb2893e2e9c6

    • SSDEEP

      3072:gteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzC9qM:0q7fYIHBZkTB6DWruUCOwjt

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks