General

  • Target

    0ce63bd857e6d627e9eb334c3ff96ebb_JaffaCakes118

  • Size

    307KB

  • Sample

    240501-3vaqrsch27

  • MD5

    0ce63bd857e6d627e9eb334c3ff96ebb

  • SHA1

    1fd819ad4d60a03e9b1893a22df13a099d3ed277

  • SHA256

    8fae1551ce2702e606275813ed66a7a35b4da08b2820df3d2c8aa0efc1ad0a98

  • SHA512

    f3962bbc2524affece19dfad75483c5e5f8deb0f4421d9c834961f67814b820d730b1d1771956f24cca00b6438fa496dc70fbaa0c30ad7343fed9a4aa1e84e19

  • SSDEEP

    6144:Md+egsj02eiWnG+3aqbPEZDmETtXjUbpUsYSjUtxM:Md2sj09iWG+3tbPEdvt4BYvM

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.208.125.192:443

165.227.156.155:443

104.239.175.211:8080

67.225.179.64:8080

46.105.131.87:80

45.33.49.124:443

183.102.238.69:465

190.51.63.1:80

87.106.139.101:8080

78.24.219.147:8080

86.22.221.170:80

94.205.247.10:80

31.12.67.62:7080

190.145.67.134:8090

87.230.19.21:8080

179.12.170.148:8080

5.196.74.210:8080

181.57.193.14:80

182.176.132.213:8090

173.249.47.77:8080

rsa_pubkey.plain

Targets

    • Target

      0ce63bd857e6d627e9eb334c3ff96ebb_JaffaCakes118

    • Size

      307KB

    • MD5

      0ce63bd857e6d627e9eb334c3ff96ebb

    • SHA1

      1fd819ad4d60a03e9b1893a22df13a099d3ed277

    • SHA256

      8fae1551ce2702e606275813ed66a7a35b4da08b2820df3d2c8aa0efc1ad0a98

    • SHA512

      f3962bbc2524affece19dfad75483c5e5f8deb0f4421d9c834961f67814b820d730b1d1771956f24cca00b6438fa496dc70fbaa0c30ad7343fed9a4aa1e84e19

    • SSDEEP

      6144:Md+egsj02eiWnG+3aqbPEZDmETtXjUbpUsYSjUtxM:Md2sj09iWG+3tbPEdvt4BYvM

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks