General

  • Target

    4aef17afe3200c64a3c0f9535d31259d_JaffaCakes118

  • Size

    696KB

  • Sample

    240516-n2jvpabg38

  • MD5

    4aef17afe3200c64a3c0f9535d31259d

  • SHA1

    16e7a6bd5ac07a62410774f1d71f69c90528d34f

  • SHA256

    1f319b9684d082cf9be356449343f83f1ff53a13ba0afda9d6d1ebb596036ea1

  • SHA512

    3bff1e88fc246d3310e6808c246f0efbdbc636b3d7039362045df01498bf9ab404562616dad5f4563788f939baea0ea316a529f22a1c64cec8cfdc73ad0cb67d

  • SSDEEP

    12288:AMzCEh70HZRYuqmQiLPa3LVJgmhMYU31:rhXgH

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

148.72.151.34:8080

37.187.2.199:443

173.249.47.77:8080

62.75.187.192:8080

181.143.194.138:443

133.167.80.63:7080

182.176.132.213:8090

37.157.194.134:443

152.89.236.214:8080

86.98.25.30:53

144.139.247.220:80

47.41.213.2:22

31.12.67.62:7080

83.136.245.190:8080

87.106.136.232:8080

178.210.51.222:8080

92.222.216.44:8080

159.65.25.128:8080

94.177.216.217:8080

182.76.6.2:8080

rsa_pubkey.plain

Targets

    • Target

      4aef17afe3200c64a3c0f9535d31259d_JaffaCakes118

    • Size

      696KB

    • MD5

      4aef17afe3200c64a3c0f9535d31259d

    • SHA1

      16e7a6bd5ac07a62410774f1d71f69c90528d34f

    • SHA256

      1f319b9684d082cf9be356449343f83f1ff53a13ba0afda9d6d1ebb596036ea1

    • SHA512

      3bff1e88fc246d3310e6808c246f0efbdbc636b3d7039362045df01498bf9ab404562616dad5f4563788f939baea0ea316a529f22a1c64cec8cfdc73ad0cb67d

    • SSDEEP

      12288:AMzCEh70HZRYuqmQiLPa3LVJgmhMYU31:rhXgH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks