General

  • Target

    54267330bcd69f6767510d1c10572a09_JaffaCakes118

  • Size

    312KB

  • Sample

    240518-ltsfraea4v

  • MD5

    54267330bcd69f6767510d1c10572a09

  • SHA1

    dcede8210e1bd860e2f0ce87550f0d4f6e708cd7

  • SHA256

    39cb7105e4c4346f37e37b8475593d156917615433ff6588009d708d71594c7f

  • SHA512

    f9438ddaf67e32f7ae89fa0175a6b9390891b660ce51772894f4f63a03640f64756123929ab5b409ca44df54264048f4978fa7667d4e14b8d44f034c703a968b

  • SSDEEP

    6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstJ:BViYC3aZU53QuIjLKdwGgH

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

68.187.160.28:443

97.120.32.227:80

187.188.166.192:8080

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

68.174.15.223:80

63.246.252.234:80

93.148.252.90:80

74.59.187.94:80

185.160.212.3:80

46.28.111.142:7080

183.99.239.141:80

68.129.203.162:443

144.139.56.105:80

191.183.21.190:80

81.157.234.90:8080

138.68.106.4:7080

203.130.0.69:80

rsa_pubkey.plain

Targets

    • Target

      54267330bcd69f6767510d1c10572a09_JaffaCakes118

    • Size

      312KB

    • MD5

      54267330bcd69f6767510d1c10572a09

    • SHA1

      dcede8210e1bd860e2f0ce87550f0d4f6e708cd7

    • SHA256

      39cb7105e4c4346f37e37b8475593d156917615433ff6588009d708d71594c7f

    • SHA512

      f9438ddaf67e32f7ae89fa0175a6b9390891b660ce51772894f4f63a03640f64756123929ab5b409ca44df54264048f4978fa7667d4e14b8d44f034c703a968b

    • SSDEEP

      6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstJ:BViYC3aZU53QuIjLKdwGgH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks