General

  • Target

    128ffd66f2dfc90667dc7fc8e45ad8eb_JaffaCakes118

  • Size

    96KB

  • Sample

    240504-nrrsjsch4v

  • MD5

    128ffd66f2dfc90667dc7fc8e45ad8eb

  • SHA1

    7ee66e7861913a987a06e3e66aa94f33ac320bae

  • SHA256

    e722b4f7e113382918dce385f25494b3e099727f33ab9f4d8b0f29ba57eca1be

  • SHA512

    97954e282addeb5fd6fa78633c0317e53ae8b25a44f1243dc3601dc095be6093225aa8c7d3882a894dd1085ca53db74d93db2bdcc73b825d6fd742ad7bff24ee

  • SSDEEP

    1536:ONfzLLiKrzj3f0tcC9Rq204xKZHZWX2oppUeCW2Bh:ONLLLiKrzj38C2RxePqpUv7H

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.102.48.180:80

192.210.135.126:8080

67.205.85.243:8080

47.146.32.175:80

116.203.32.252:8080

189.212.199.126:443

72.12.127.184:443

180.92.239.110:8080

103.86.49.11:8080

181.230.116.163:80

157.147.76.151:80

74.120.55.163:80

121.124.124.40:7080

79.98.24.39:8080

142.105.151.124:443

167.86.90.214:8080

24.179.13.119:80

62.138.26.28:8080

165.165.171.160:8080

74.208.45.104:8080

rsa_pubkey.plain

Targets

    • Target

      128ffd66f2dfc90667dc7fc8e45ad8eb_JaffaCakes118

    • Size

      96KB

    • MD5

      128ffd66f2dfc90667dc7fc8e45ad8eb

    • SHA1

      7ee66e7861913a987a06e3e66aa94f33ac320bae

    • SHA256

      e722b4f7e113382918dce385f25494b3e099727f33ab9f4d8b0f29ba57eca1be

    • SHA512

      97954e282addeb5fd6fa78633c0317e53ae8b25a44f1243dc3601dc095be6093225aa8c7d3882a894dd1085ca53db74d93db2bdcc73b825d6fd742ad7bff24ee

    • SSDEEP

      1536:ONfzLLiKrzj3f0tcC9Rq204xKZHZWX2oppUeCW2Bh:ONLLLiKrzj38C2RxePqpUv7H

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks