General

  • Target

    JaffaCakes118_29bdc4b8b7b6d6676fe940370924dafd042c51fcc80cffcf2211853c1ff7ed8f

  • Size

    177KB

  • Sample

    241230-zkr1hs1jgy

  • MD5

    3c45e9afef9b56f55db97b39a76f9d01

  • SHA1

    cfde3475c2f88f02f15d796b5db2e82763124397

  • SHA256

    29bdc4b8b7b6d6676fe940370924dafd042c51fcc80cffcf2211853c1ff7ed8f

  • SHA512

    c1f0562d8793bb9ddcba8823f4acae11a48cc98267f2cbb05d1829fc3ab89cec060c98acb637f55fca9f4269735f152756a12f19922eb393fe9ec326fc325b9a

  • SSDEEP

    3072:OoNQK/z2dvUgKrjbeSUAjnERwDkCWptcvcb8qgAE0A2C8FQUVac8SurKI6bl/g:haIzLgKrjbvUAjERycp6c8qgATA2TQUr

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.79.91.89:9987

157.245.231.228:6051

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_29bdc4b8b7b6d6676fe940370924dafd042c51fcc80cffcf2211853c1ff7ed8f

    • Size

      177KB

    • MD5

      3c45e9afef9b56f55db97b39a76f9d01

    • SHA1

      cfde3475c2f88f02f15d796b5db2e82763124397

    • SHA256

      29bdc4b8b7b6d6676fe940370924dafd042c51fcc80cffcf2211853c1ff7ed8f

    • SHA512

      c1f0562d8793bb9ddcba8823f4acae11a48cc98267f2cbb05d1829fc3ab89cec060c98acb637f55fca9f4269735f152756a12f19922eb393fe9ec326fc325b9a

    • SSDEEP

      3072:OoNQK/z2dvUgKrjbeSUAjnERwDkCWptcvcb8qgAE0A2C8FQUVac8SurKI6bl/g:haIzLgKrjbvUAjERycp6c8qgATA2TQUr

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks