General

  • Target

    5353101e9eecb170a46850bc03e9a2c9_JaffaCakes118

  • Size

    132KB

  • Sample

    240518-gzq3nafc3z

  • MD5

    5353101e9eecb170a46850bc03e9a2c9

  • SHA1

    25b4ea2cf6e2c99b5954db08737521f675299d2a

  • SHA256

    c20f2837a05635b2ece6777c6c194ad4f0a3a1f611d344ee21c2b398f1c3a3b8

  • SHA512

    ae1cfd5b40dac2faf20bf82e23d67c7ccdc3ba74eec5b8b94145f3777fe9685003119583e9d1d2156b4dd61074050ba26eb55181464bb7f7229778056eef0d97

  • SSDEEP

    1536:UmYczEyk9QpGW+Za5fpieSQr5RCs6Hl68+895baYCSjTZyl2JtXaBIYH7prGOl1d:U4z+Qk/Je5u1P95ba2E0qBDbpacaxbm

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

73.167.135.180:80

72.29.55.174:80

63.246.252.234:80

104.236.137.72:8080

172.104.233.225:8080

213.189.36.51:8080

85.234.143.94:8080

200.123.101.90:80

203.25.159.3:8080

134.209.214.126:8080

88.250.223.190:8080

190.186.164.23:80

82.196.15.205:8080

110.143.18.92:80

91.204.163.19:8090

14.160.93.230:80

159.203.204.126:8080

200.58.83.179:80

163.172.40.218:7080

189.173.113.67:443

rsa_pubkey.plain

Targets

    • Target

      5353101e9eecb170a46850bc03e9a2c9_JaffaCakes118

    • Size

      132KB

    • MD5

      5353101e9eecb170a46850bc03e9a2c9

    • SHA1

      25b4ea2cf6e2c99b5954db08737521f675299d2a

    • SHA256

      c20f2837a05635b2ece6777c6c194ad4f0a3a1f611d344ee21c2b398f1c3a3b8

    • SHA512

      ae1cfd5b40dac2faf20bf82e23d67c7ccdc3ba74eec5b8b94145f3777fe9685003119583e9d1d2156b4dd61074050ba26eb55181464bb7f7229778056eef0d97

    • SSDEEP

      1536:UmYczEyk9QpGW+Za5fpieSQr5RCs6Hl68+895baYCSjTZyl2JtXaBIYH7prGOl1d:U4z+Qk/Je5u1P95ba2E0qBDbpacaxbm

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks