General

  • Target

    0426c190f3a50491615801adbc851945_JaffaCakes118

  • Size

    483KB

  • Sample

    240428-cnjrzsec9y

  • MD5

    0426c190f3a50491615801adbc851945

  • SHA1

    5bc87dc997af64d0430cfd5f32ce1b01f9253c98

  • SHA256

    58172da0d25c25a615faafeebb59a19b7f5c3e639d1f6785b0142e68446b9377

  • SHA512

    bf32eb3e831f8ac4bcb2f1a018c90385322924b6451dfe9360fcc3e4900b139cf3f9a6e7e1d1adc3026f88b50048d25a5ea6882e6d378b56641bae28d63606d4

  • SSDEEP

    12288:BoRKSt5ffQzhniC5BbxmLrZMFhle+3qvcN9wGdH1gGMeDp:DmLOhk+3qvcvwGdH1/9

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

185.215.227.107:443

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

172.104.169.32:8080

68.183.190.199:8080

187.162.248.237:80

82.76.111.249:443

184.66.18.83:80

190.6.193.152:8080

77.238.212.227:80

199.203.62.165:80

188.2.217.94:80

185.94.252.12:80

178.250.54.208:8080

206.15.68.237:443

65.36.62.20:80

216.47.196.104:80

219.92.8.17:8080

213.60.96.117:80

rsa_pubkey.plain

Targets

    • Target

      0426c190f3a50491615801adbc851945_JaffaCakes118

    • Size

      483KB

    • MD5

      0426c190f3a50491615801adbc851945

    • SHA1

      5bc87dc997af64d0430cfd5f32ce1b01f9253c98

    • SHA256

      58172da0d25c25a615faafeebb59a19b7f5c3e639d1f6785b0142e68446b9377

    • SHA512

      bf32eb3e831f8ac4bcb2f1a018c90385322924b6451dfe9360fcc3e4900b139cf3f9a6e7e1d1adc3026f88b50048d25a5ea6882e6d378b56641bae28d63606d4

    • SSDEEP

      12288:BoRKSt5ffQzhniC5BbxmLrZMFhle+3qvcN9wGdH1gGMeDp:DmLOhk+3qvcvwGdH1/9

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks