General

  • Target

    420239b3707272fb42f4effb8c31bb8c_JaffaCakes118

  • Size

    172KB

  • Sample

    240514-s1f5macg3w

  • MD5

    420239b3707272fb42f4effb8c31bb8c

  • SHA1

    ccd5a61ff07aba8ec2d64a79c61c996826476b4c

  • SHA256

    d174de4b9f8bd2689050d7dc7d9931e4f8a3a904ab93244b43a2b8730dd73e4d

  • SHA512

    656163dfebabb2c6fc7a9394ab876e6fcc5fb5971d6e76b5079f40be337507a72a5359be5022171274a85588e0399f41e1415e88ab4e4007357ebdb262b97dbc

  • SSDEEP

    3072:WrrswIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrzIL8/Xatd54AddF8

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

223.133.20.171:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

58.27.215.3:8080

220.147.247.145:80

139.59.12.63:8080

185.142.236.163:443

113.156.82.32:80

126.126.139.26:443

198.57.203.63:8080

181.137.229.1:80

95.216.205.155:8080

37.187.100.220:7080

50.116.78.109:8080

37.205.9.252:7080

172.105.78.244:8080

103.133.66.57:443

91.75.75.46:80

46.105.131.68:8080

rsa_pubkey.plain

Targets

    • Target

      420239b3707272fb42f4effb8c31bb8c_JaffaCakes118

    • Size

      172KB

    • MD5

      420239b3707272fb42f4effb8c31bb8c

    • SHA1

      ccd5a61ff07aba8ec2d64a79c61c996826476b4c

    • SHA256

      d174de4b9f8bd2689050d7dc7d9931e4f8a3a904ab93244b43a2b8730dd73e4d

    • SHA512

      656163dfebabb2c6fc7a9394ab876e6fcc5fb5971d6e76b5079f40be337507a72a5359be5022171274a85588e0399f41e1415e88ab4e4007357ebdb262b97dbc

    • SSDEEP

      3072:WrrswIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrzIL8/Xatd54AddF8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks