General

  • Target

    55778dc2aeec0dc35b62e7027bf27a54_JaffaCakes118

  • Size

    244KB

  • Sample

    240518-s1kg2sad4y

  • MD5

    55778dc2aeec0dc35b62e7027bf27a54

  • SHA1

    7ff2f7927a3cd758a228419c096c14d2ae2d5a02

  • SHA256

    9cb3c07fca1595e3a6ba3893aa788595a050418eabc5a5307350b117af8689ce

  • SHA512

    0dcab2d675b963c3d27d178b72f4b9e39c4053d1d5ecf190a6a1ece878a72e92a3f8851d27a228c5681f6002d930b11d135bbbcee21af0d1233a975e88d99f06

  • SSDEEP

    3072:yjQlpRi39Mm+sQ71Rdjauo1GUVPEIEqLtH:y0lpRaMdJ1vjiPEc5H

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080

rsa_pubkey.plain

Targets

    • Target

      55778dc2aeec0dc35b62e7027bf27a54_JaffaCakes118

    • Size

      244KB

    • MD5

      55778dc2aeec0dc35b62e7027bf27a54

    • SHA1

      7ff2f7927a3cd758a228419c096c14d2ae2d5a02

    • SHA256

      9cb3c07fca1595e3a6ba3893aa788595a050418eabc5a5307350b117af8689ce

    • SHA512

      0dcab2d675b963c3d27d178b72f4b9e39c4053d1d5ecf190a6a1ece878a72e92a3f8851d27a228c5681f6002d930b11d135bbbcee21af0d1233a975e88d99f06

    • SSDEEP

      3072:yjQlpRi39Mm+sQ71Rdjauo1GUVPEIEqLtH:y0lpRaMdJ1vjiPEc5H

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks