General

  • Target

    1231b5eec3313cfa095756fa5aaf1b19_JaffaCakes118

  • Size

    292KB

  • Sample

    240504-lxbbmsae5x

  • MD5

    1231b5eec3313cfa095756fa5aaf1b19

  • SHA1

    2c1fc4c629beb4c47601e8dda05fff90fc4571a4

  • SHA256

    03ecef991175f232bdf1326550ac5c554c6298108d163d5d74782d2074ea1aea

  • SHA512

    8cb19e7e0a383e8ffed7ccab2f3a4e7b11153fe65b2928018458911fd7bc8b12df5b084779fb9ada39c03bcc7d0370ea944f5bc2701c8d128bbddbf506e74aa0

  • SSDEEP

    3072:DEHl+12VRmHgkbaSyOw6ULoIv3VyGfbM+6zFkCfunSEiDGuxji8lxdNb1849uDrc:DQ+2VRMaPOO53gvGSrmm3AA

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

104.236.137.72:8080

172.104.233.225:8080

81.169.140.14:443

213.189.36.51:8080

87.106.77.40:7080

86.42.166.147:80

200.113.106.18:80

45.79.95.107:443

125.99.61.162:7080

181.16.17.210:443

207.154.204.40:8080

91.204.163.19:8090

201.190.133.235:8080

91.83.93.124:7080

163.172.40.218:7080

149.62.173.247:8080

189.173.113.67:443

68.183.190.199:8080

190.210.184.138:995

142.127.57.63:8080

rsa_pubkey.plain

Targets

    • Target

      1231b5eec3313cfa095756fa5aaf1b19_JaffaCakes118

    • Size

      292KB

    • MD5

      1231b5eec3313cfa095756fa5aaf1b19

    • SHA1

      2c1fc4c629beb4c47601e8dda05fff90fc4571a4

    • SHA256

      03ecef991175f232bdf1326550ac5c554c6298108d163d5d74782d2074ea1aea

    • SHA512

      8cb19e7e0a383e8ffed7ccab2f3a4e7b11153fe65b2928018458911fd7bc8b12df5b084779fb9ada39c03bcc7d0370ea944f5bc2701c8d128bbddbf506e74aa0

    • SSDEEP

      3072:DEHl+12VRmHgkbaSyOw6ULoIv3VyGfbM+6zFkCfunSEiDGuxji8lxdNb1849uDrc:DQ+2VRMaPOO53gvGSrmm3AA

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks