General

  • Target

    JaffaCakes118_4412cf6658ee6d0cd1f0dc8946e461a1

  • Size

    608KB

  • Sample

    250101-c2eeestncl

  • MD5

    4412cf6658ee6d0cd1f0dc8946e461a1

  • SHA1

    c168eb00ae923bad8b19bd8c08d4b8fac68e9e7b

  • SHA256

    6389ea94a79de7bf09c128d9fb8e69276bb611e636bd9bce7ace82e43ec2e369

  • SHA512

    bb2d70e0fb7b4bb4c03b6e507f9d64c622b24b20802e9e8258fdc2db7a13f11aaae9316ae2cc7c7910ef6e4a4cb980747edc761e0d803057aa11f816f9a7305e

  • SSDEEP

    12288:DZGQdqOGFSJqydLqQSeCqsVK8kPRGO35N9mV2zXc6:DZ0gWjeCVVK8kP9N9oS

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain
rc4.plain

Targets

    • Target

      JaffaCakes118_4412cf6658ee6d0cd1f0dc8946e461a1

    • Size

      608KB

    • MD5

      4412cf6658ee6d0cd1f0dc8946e461a1

    • SHA1

      c168eb00ae923bad8b19bd8c08d4b8fac68e9e7b

    • SHA256

      6389ea94a79de7bf09c128d9fb8e69276bb611e636bd9bce7ace82e43ec2e369

    • SHA512

      bb2d70e0fb7b4bb4c03b6e507f9d64c622b24b20802e9e8258fdc2db7a13f11aaae9316ae2cc7c7910ef6e4a4cb980747edc761e0d803057aa11f816f9a7305e

    • SSDEEP

      12288:DZGQdqOGFSJqydLqQSeCqsVK8kPRGO35N9mV2zXc6:DZ0gWjeCVVK8kP9N9oS

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks