General

  • Target

    JaffaCakes118_99c3c1b8166f21ff4c3b4ec883dab4c2dfffa31a79060ad459b99725b39e74bb

  • Size

    161KB

  • Sample

    241230-zkg6ba1jfv

  • MD5

    577175b62c6c654e8d9f1ca66e790ae9

  • SHA1

    b8ecbfdd69fab7045cffcb9e8ac068aede289bb4

  • SHA256

    99c3c1b8166f21ff4c3b4ec883dab4c2dfffa31a79060ad459b99725b39e74bb

  • SHA512

    0cbf7eec793d4ff67a0384c0f5934057bc23001b0e08c073a4d4b98ba2601781f5d2ed2db56d5dcd23c6ed7b855890d67c40898373afef968dfdb4c0279917c0

  • SSDEEP

    3072:id63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrU1Cx3:2a/jkvhSlP/7bg8aFnA3brX

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

193.200.130.181:443

95.138.161.226:2303

167.114.113.13:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_99c3c1b8166f21ff4c3b4ec883dab4c2dfffa31a79060ad459b99725b39e74bb

    • Size

      161KB

    • MD5

      577175b62c6c654e8d9f1ca66e790ae9

    • SHA1

      b8ecbfdd69fab7045cffcb9e8ac068aede289bb4

    • SHA256

      99c3c1b8166f21ff4c3b4ec883dab4c2dfffa31a79060ad459b99725b39e74bb

    • SHA512

      0cbf7eec793d4ff67a0384c0f5934057bc23001b0e08c073a4d4b98ba2601781f5d2ed2db56d5dcd23c6ed7b855890d67c40898373afef968dfdb4c0279917c0

    • SSDEEP

      3072:id63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrU1Cx3:2a/jkvhSlP/7bg8aFnA3brX

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks