General

  • Target

    0c97ae4bc6b26b6c10c0072852a06500_JaffaCakes118

  • Size

    667KB

  • Sample

    240501-xnbftsdh31

  • MD5

    0c97ae4bc6b26b6c10c0072852a06500

  • SHA1

    5c729658417b63103214b7cdbfe08c2842e7e6e9

  • SHA256

    dbd89be0542fccb6e27a42b27c53b9a8978c53ce0adc72c1cae1dec278fc203d

  • SHA512

    c333ade459acbae05f7424850d9126026c40379e7cdbfdeb8549892cd79279d48e8750c1a95d6f88ddfeff3f672a6beb1f4a9b2cafc79182e350bfcde3400364

  • SSDEEP

    12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCNbnG:76J6/tniVNoDgQVN6mCip9NbG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain

Targets

    • Target

      0c97ae4bc6b26b6c10c0072852a06500_JaffaCakes118

    • Size

      667KB

    • MD5

      0c97ae4bc6b26b6c10c0072852a06500

    • SHA1

      5c729658417b63103214b7cdbfe08c2842e7e6e9

    • SHA256

      dbd89be0542fccb6e27a42b27c53b9a8978c53ce0adc72c1cae1dec278fc203d

    • SHA512

      c333ade459acbae05f7424850d9126026c40379e7cdbfdeb8549892cd79279d48e8750c1a95d6f88ddfeff3f672a6beb1f4a9b2cafc79182e350bfcde3400364

    • SSDEEP

      12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCNbnG:76J6/tniVNoDgQVN6mCip9NbG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks