General

  • Target

    5310e0556834e80ef9eb0bcf278852f5_JaffaCakes118

  • Size

    392KB

  • Sample

    240518-e9jefscb7x

  • MD5

    5310e0556834e80ef9eb0bcf278852f5

  • SHA1

    ae1b37fff2da0dd55e3cfe5e60835dc563d34f97

  • SHA256

    5088f9fc000f8c162c58cf6e6c8c2440db33697d1b5edb8da49d6e9e56e50d2e

  • SHA512

    19bb1b37391e0692d7c0cf920eaaecbf9fef58320e14b6c00711abe72090b4edf0556c8038eb3eb44529bf4a3e1eaf0f818b1006572dad626c41f60a126e1a4d

  • SSDEEP

    6144:vQwl8GGD02Q98eFRDtelT6LXdooCXV5DLvmgB76/Sj2tcm5dqa5/sZS:vr8XD0DxDtyQXS5uPUiz5r57

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

50.63.13.135:8080

80.211.32.88:8080

222.239.249.166:443

54.38.94.197:8080

78.46.87.133:8080

191.100.24.201:50000

200.71.112.158:53

212.129.14.27:8080

190.189.79.73:80

176.58.93.123:80

113.52.135.33:7080

161.18.233.114:80

46.17.6.116:8080

192.241.220.183:8080

162.144.46.90:8080

95.216.207.86:7080

95.216.212.157:8080

217.26.163.82:7080

50.116.78.109:8080

142.93.87.198:8080

rsa_pubkey.plain

Targets

    • Target

      5310e0556834e80ef9eb0bcf278852f5_JaffaCakes118

    • Size

      392KB

    • MD5

      5310e0556834e80ef9eb0bcf278852f5

    • SHA1

      ae1b37fff2da0dd55e3cfe5e60835dc563d34f97

    • SHA256

      5088f9fc000f8c162c58cf6e6c8c2440db33697d1b5edb8da49d6e9e56e50d2e

    • SHA512

      19bb1b37391e0692d7c0cf920eaaecbf9fef58320e14b6c00711abe72090b4edf0556c8038eb3eb44529bf4a3e1eaf0f818b1006572dad626c41f60a126e1a4d

    • SSDEEP

      6144:vQwl8GGD02Q98eFRDtelT6LXdooCXV5DLvmgB76/Sj2tcm5dqa5/sZS:vr8XD0DxDtyQXS5uPUiz5r57

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks