General

  • Target

    0a150bb4818830015d3d5119fde65c48_JaffaCakes118

  • Size

    216KB

  • Sample

    240430-s2nabsab3y

  • MD5

    0a150bb4818830015d3d5119fde65c48

  • SHA1

    3714c53e0a8aa937ffa4aacb90afea41bce75ed8

  • SHA256

    186da342c1f435d7d864bfd00025cfc69add8d490d2abb7b9b3b3b0f44b3e156

  • SHA512

    1ec229ae4c7c83eff543e4b7fe5ed57c86372b8f2016921fd7979f0fce0a6d76abba748b8a6dad708c4d36d4d899150c08696c373bb85b6e23646d1df4495309

  • SSDEEP

    3072:t0bbG3u+UULgpJrHp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrkrzxsW9ZKQhc

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

108.46.29.236:80

159.203.116.47:8080

173.249.6.108:443

94.124.59.22:8080

94.200.114.161:80

139.130.242.43:80

134.209.36.254:8080

74.208.45.104:8080

139.162.108.71:8080

47.144.21.12:443

95.213.236.64:8080

201.173.217.124:443

85.105.205.77:8080

85.152.162.105:80

153.137.36.142:80

87.106.136.232:8080

87.106.139.101:8080

213.196.135.145:80

67.10.155.92:80

168.235.67.138:7080

rsa_pubkey.plain

Targets

    • Target

      0a150bb4818830015d3d5119fde65c48_JaffaCakes118

    • Size

      216KB

    • MD5

      0a150bb4818830015d3d5119fde65c48

    • SHA1

      3714c53e0a8aa937ffa4aacb90afea41bce75ed8

    • SHA256

      186da342c1f435d7d864bfd00025cfc69add8d490d2abb7b9b3b3b0f44b3e156

    • SHA512

      1ec229ae4c7c83eff543e4b7fe5ed57c86372b8f2016921fd7979f0fce0a6d76abba748b8a6dad708c4d36d4d899150c08696c373bb85b6e23646d1df4495309

    • SSDEEP

      3072:t0bbG3u+UULgpJrHp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrkrzxsW9ZKQhc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks