General

  • Target

    0dab174bfcbd1e6b372038a95e7b1922_JaffaCakes118

  • Size

    308KB

  • Sample

    240502-ghxtwace84

  • MD5

    0dab174bfcbd1e6b372038a95e7b1922

  • SHA1

    e3abe327f8880d9f913c2097d09416beee7ee08a

  • SHA256

    a0a99a113c7d2e483ec5047be856034fcb4f6b620ccd6556bae15e01e99309e4

  • SHA512

    b5610612108d6dcd86cc6858117350cc6aae32549246fbec7cbad0f7d444cb46e8997ee80369787b83a62a34c178c5d58ec0ad97708fb0d9706d2f2470a3de01

  • SSDEEP

    3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZep:MPCum81YIPQMCuyDDlB25y4Zep

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Targets

    • Target

      0dab174bfcbd1e6b372038a95e7b1922_JaffaCakes118

    • Size

      308KB

    • MD5

      0dab174bfcbd1e6b372038a95e7b1922

    • SHA1

      e3abe327f8880d9f913c2097d09416beee7ee08a

    • SHA256

      a0a99a113c7d2e483ec5047be856034fcb4f6b620ccd6556bae15e01e99309e4

    • SHA512

      b5610612108d6dcd86cc6858117350cc6aae32549246fbec7cbad0f7d444cb46e8997ee80369787b83a62a34c178c5d58ec0ad97708fb0d9706d2f2470a3de01

    • SSDEEP

      3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZep:MPCum81YIPQMCuyDDlB25y4Zep

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks