General

  • Target

    JaffaCakes118_245ae4074b5fafb4820e8389b1069c9655276e8a874f8d3e229d35269c2eb2c8

  • Size

    171KB

  • Sample

    241230-zn4tgs1ldt

  • MD5

    edaf8674f410714df6802db1ed4243b9

  • SHA1

    5ad8448203731a74e5b8e095bfee81e2438f0924

  • SHA256

    245ae4074b5fafb4820e8389b1069c9655276e8a874f8d3e229d35269c2eb2c8

  • SHA512

    534d618fa2f814e9a50d6070cbdca44528ab06256c13b2dde9cf1b6e6f765f3cdb9c6d42f5e31754458a4e2c543ce5062284b957e7943b6c0092369b91db1ec4

  • SSDEEP

    3072:Mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:MH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_245ae4074b5fafb4820e8389b1069c9655276e8a874f8d3e229d35269c2eb2c8

    • Size

      171KB

    • MD5

      edaf8674f410714df6802db1ed4243b9

    • SHA1

      5ad8448203731a74e5b8e095bfee81e2438f0924

    • SHA256

      245ae4074b5fafb4820e8389b1069c9655276e8a874f8d3e229d35269c2eb2c8

    • SHA512

      534d618fa2f814e9a50d6070cbdca44528ab06256c13b2dde9cf1b6e6f765f3cdb9c6d42f5e31754458a4e2c543ce5062284b957e7943b6c0092369b91db1ec4

    • SSDEEP

      3072:Mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:MH9RVaPEmsdHdbQUbd2H3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks