General

  • Target

    591371f612bf38e9dca92ec05ca20cf6_JaffaCakes118

  • Size

    65KB

  • Sample

    240519-hljl4afb3t

  • MD5

    591371f612bf38e9dca92ec05ca20cf6

  • SHA1

    83b0163fa32985bb884c39c0d9189ff2700ec09c

  • SHA256

    b29f3bdfc790dd984ce541aec3cca1fe48d18ad893d62b3b96274281ac62581e

  • SHA512

    c28d6b127ac4a1ab39951baf814f265bcc56124a7358b9f06c365f77238c944f05c75a16b000199b0b74755387ef05e34d769281b6a7ed518fb480c973301980

  • SSDEEP

    1536:HSQpv/ns4Q6UxkPWrbvkM8qLv1ASGZq4nvM6cCrc5hf8ILVV2MIlQ:yQns4UxkesgASGZtM6VKVYQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

69.14.208.221:80

156.155.163.232:80

211.42.204.154:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

182.176.116.139:995

72.51.153.27:80

124.150.175.129:8080

96.234.38.186:8080

139.59.12.63:8080

220.78.29.88:80

190.38.252.45:443

128.92.54.20:80

94.203.236.122:80

46.105.131.68:8080

162.144.46.90:8080

59.158.164.66:443

95.255.140.89:443

rsa_pubkey.plain

Targets

    • Target

      591371f612bf38e9dca92ec05ca20cf6_JaffaCakes118

    • Size

      65KB

    • MD5

      591371f612bf38e9dca92ec05ca20cf6

    • SHA1

      83b0163fa32985bb884c39c0d9189ff2700ec09c

    • SHA256

      b29f3bdfc790dd984ce541aec3cca1fe48d18ad893d62b3b96274281ac62581e

    • SHA512

      c28d6b127ac4a1ab39951baf814f265bcc56124a7358b9f06c365f77238c944f05c75a16b000199b0b74755387ef05e34d769281b6a7ed518fb480c973301980

    • SSDEEP

      1536:HSQpv/ns4Q6UxkPWrbvkM8qLv1ASGZq4nvM6cCrc5hf8ILVV2MIlQ:yQns4UxkesgASGZtM6VKVYQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks