General

  • Target

    129a61c8b23263cfdf72f551ca5c7229_JaffaCakes118

  • Size

    168KB

  • Sample

    240504-nzah8sdb6w

  • MD5

    129a61c8b23263cfdf72f551ca5c7229

  • SHA1

    75180c01d4eb822052954b2a1d51746f8d89c93e

  • SHA256

    ed4d45ea81b11ef749f9e62fe95543cfc859b746c87e529824b5f8c17476f6a3

  • SHA512

    8aaafac68507e5dd4c3df143359c8d4fa3432b0252b07d098e3b6d67dceb010b878c781b41e2e4ac754a56e9dc11dcfcbe9fe898cb7de91f2c02dc168d217bed

  • SSDEEP

    1536:r3yCxVaZPMWxILZRH8jdrGIp/HGmMUch7a/bD:7HxVaZ04CRHmhV/mmkdEbD

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

107.5.122.110:80

199.101.86.6:443

45.55.219.163:443

62.30.7.67:443

185.94.252.104:443

203.117.253.142:80

93.51.50.171:8080

139.130.242.43:80

181.230.116.163:80

37.187.72.193:8080

194.187.133.160:443

167.86.90.214:8080

61.19.246.238:443

98.109.204.230:80

180.92.239.110:8080

121.124.124.40:7080

47.146.117.214:80

110.145.77.103:80

97.82.79.83:80

70.121.172.89:80

rsa_pubkey.plain

Targets

    • Target

      129a61c8b23263cfdf72f551ca5c7229_JaffaCakes118

    • Size

      168KB

    • MD5

      129a61c8b23263cfdf72f551ca5c7229

    • SHA1

      75180c01d4eb822052954b2a1d51746f8d89c93e

    • SHA256

      ed4d45ea81b11ef749f9e62fe95543cfc859b746c87e529824b5f8c17476f6a3

    • SHA512

      8aaafac68507e5dd4c3df143359c8d4fa3432b0252b07d098e3b6d67dceb010b878c781b41e2e4ac754a56e9dc11dcfcbe9fe898cb7de91f2c02dc168d217bed

    • SSDEEP

      1536:r3yCxVaZPMWxILZRH8jdrGIp/HGmMUch7a/bD:7HxVaZ04CRHmhV/mmkdEbD

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks