Resubmissions

07-05-2024 01:02

240507-bdzvsaeb95 10

07-05-2024 00:58

240507-bbyjyaea97 10

General

  • Target

    1ee857ff939ac27a4cc98e4e904f9d0d_JaffaCakes118

  • Size

    116KB

  • Sample

    240507-bdzvsaeb95

  • MD5

    1ee857ff939ac27a4cc98e4e904f9d0d

  • SHA1

    39db746340260f9285bd1d448c4421ef0e02eb8a

  • SHA256

    a6d9f6d44c7d5949925c2b188f9244a15f5f92895dfc455804fc3f66164fba3a

  • SHA512

    64c3d309aa68f148120e0d184cd015b0a0a06f21b0d7b47dc8fae9fee2b46c747122f316e45729bacd2e856c79965ffa57eeb8f742df5b74ceeb0e16e3899ac7

  • SSDEEP

    3072:cChC6NAN/FuTmngEyyIVVoFmAS8n34aQSxyT9:c0CTN/gTagEyxojDILS8

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

192.158.216.73:80

85.214.28.226:8080

142.44.137.67:443

162.241.242.173:8080

85.152.162.105:80

62.30.7.67:443

78.24.219.147:8080

74.120.55.163:80

169.239.182.217:8080

216.208.76.186:80

95.213.236.64:8080

200.114.213.233:8080

104.131.44.150:8080

70.121.172.89:80

75.139.38.211:80

185.94.252.104:443

97.82.79.83:80

103.86.49.11:8080

79.98.24.39:8080

83.169.36.251:8080

rsa_pubkey.plain

Targets

    • Target

      1ee857ff939ac27a4cc98e4e904f9d0d_JaffaCakes118

    • Size

      116KB

    • MD5

      1ee857ff939ac27a4cc98e4e904f9d0d

    • SHA1

      39db746340260f9285bd1d448c4421ef0e02eb8a

    • SHA256

      a6d9f6d44c7d5949925c2b188f9244a15f5f92895dfc455804fc3f66164fba3a

    • SHA512

      64c3d309aa68f148120e0d184cd015b0a0a06f21b0d7b47dc8fae9fee2b46c747122f316e45729bacd2e856c79965ffa57eeb8f742df5b74ceeb0e16e3899ac7

    • SSDEEP

      3072:cChC6NAN/FuTmngEyyIVVoFmAS8n34aQSxyT9:c0CTN/gTagEyxojDILS8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks