General

  • Target

    16101ef12317ee5c7580e49bc7f50a58_JaffaCakes118

  • Size

    682KB

  • Sample

    240505-fhtlsaff4y

  • MD5

    16101ef12317ee5c7580e49bc7f50a58

  • SHA1

    c3798e603a9637a4e77545146a6ccd8374eb8006

  • SHA256

    f75a627ed98fdf3860bfde327ab4014e73536b9a3ae1854029980d58e83039f8

  • SHA512

    ba3373f0bf4b07534d09b78c5d02c06120dd37e6b6ac24f24f19941fb4c1cad9914972c5e0b34715d1b2df15906b46ff076bc1958670334866a030e06676b479

  • SSDEEP

    12288:1Su+QgGEsmeKVFXIA33nrbDSL3bhHInj3MqhOHoRlfDcmL8j1vxwrygF:s/QQsmeKVFXIA33n3WL3bhH43+SZN8j9

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

165.227.156.155:443

104.239.175.211:8080

67.225.179.64:8080

192.241.220.155:8080

179.12.170.148:8080

5.196.74.210:8080

189.209.217.49:80

178.79.161.166:443

190.228.72.244:53

105.228.98.115:443

31.172.240.91:8080

136.243.177.26:8080

87.230.19.21:8080

171.101.153.86:990

37.157.194.134:443

209.141.41.136:8080

91.205.215.66:8080

167.99.105.223:7080

83.136.245.190:8080

167.71.10.37:8080

rsa_pubkey.plain

Targets

    • Target

      16101ef12317ee5c7580e49bc7f50a58_JaffaCakes118

    • Size

      682KB

    • MD5

      16101ef12317ee5c7580e49bc7f50a58

    • SHA1

      c3798e603a9637a4e77545146a6ccd8374eb8006

    • SHA256

      f75a627ed98fdf3860bfde327ab4014e73536b9a3ae1854029980d58e83039f8

    • SHA512

      ba3373f0bf4b07534d09b78c5d02c06120dd37e6b6ac24f24f19941fb4c1cad9914972c5e0b34715d1b2df15906b46ff076bc1958670334866a030e06676b479

    • SSDEEP

      12288:1Su+QgGEsmeKVFXIA33nrbDSL3bhHInj3MqhOHoRlfDcmL8j1vxwrygF:s/QQsmeKVFXIA33n3WL3bhH43+SZN8j9

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks