General

  • Target

    53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118

  • Size

    603KB

  • Sample

    240518-jzpwpsah9z

  • MD5

    53c0991fbe9dd8abcf27e3e0eb7a34be

  • SHA1

    8474315c356f4fc8ce070d9b9e070644fad579d2

  • SHA256

    ccc579f1b0a5c1ddb141c4af99ac8e3cbd7b86e35477f0ff3c0b8500c32a8a1e

  • SHA512

    4893bcd4ea3a1cd357d8b966d9a1166bb463727ed29bb886d1ab592422d50483e210b0ee6a6e97b0c6d6dde1a12eb410f2092fcdd7dd7770a0738e6e2717d2a7

  • SSDEEP

    12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080

rsa_pubkey.plain

Targets

    • Target

      53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118

    • Size

      603KB

    • MD5

      53c0991fbe9dd8abcf27e3e0eb7a34be

    • SHA1

      8474315c356f4fc8ce070d9b9e070644fad579d2

    • SHA256

      ccc579f1b0a5c1ddb141c4af99ac8e3cbd7b86e35477f0ff3c0b8500c32a8a1e

    • SHA512

      4893bcd4ea3a1cd357d8b966d9a1166bb463727ed29bb886d1ab592422d50483e210b0ee6a6e97b0c6d6dde1a12eb410f2092fcdd7dd7770a0738e6e2717d2a7

    • SSDEEP

      12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks