General

  • Target

    07cf1f09012d974a4cde0327c8133a7f_JaffaCakes118

  • Size

    224KB

  • Sample

    240429-q4wclsca45

  • MD5

    07cf1f09012d974a4cde0327c8133a7f

  • SHA1

    30d9e9348235178a21dc839c028fbb55011be921

  • SHA256

    68c6accbd0c17f6818a9b4090718fed1bcec72d9d79f18a28883921c64e3aee7

  • SHA512

    e949094b0d7d43e0314a8e325ebf0515ce3d7f77f7d68f38d76752f6433845992f7ae14f6a5f8294b751bf76c72fb8275a4a68a5a9bd1aaca52f3e89ecfb9a6f

  • SSDEEP

    3072:dD1v8rVu99d3eaEeh35MGCkBLP4fnpSWBomdJq2+JC+I81WEQdCnk9/:rC+OfepFCk1PMpSWSmn5+IMWxFp

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

75.80.124.4:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

107.5.122.110:80

195.251.213.56:80

91.211.88.52:7080

79.98.24.39:8080

75.139.38.211:80

82.225.49.121:80

162.241.242.173:8080

94.1.108.190:443

85.105.205.77:8080

181.169.34.190:80

24.179.13.119:80

139.59.67.118:443

82.80.155.43:80

50.91.114.38:80

93.147.212.206:80

153.232.188.106:80

rsa_pubkey.plain

Targets

    • Target

      07cf1f09012d974a4cde0327c8133a7f_JaffaCakes118

    • Size

      224KB

    • MD5

      07cf1f09012d974a4cde0327c8133a7f

    • SHA1

      30d9e9348235178a21dc839c028fbb55011be921

    • SHA256

      68c6accbd0c17f6818a9b4090718fed1bcec72d9d79f18a28883921c64e3aee7

    • SHA512

      e949094b0d7d43e0314a8e325ebf0515ce3d7f77f7d68f38d76752f6433845992f7ae14f6a5f8294b751bf76c72fb8275a4a68a5a9bd1aaca52f3e89ecfb9a6f

    • SSDEEP

      3072:dD1v8rVu99d3eaEeh35MGCkBLP4fnpSWBomdJq2+JC+I81WEQdCnk9/:rC+OfepFCk1PMpSWSmn5+IMWxFp

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks