General

  • Target

    59d10dab0637b1608a97f3e36899082e_JaffaCakes118

  • Size

    312KB

  • Sample

    240519-lznprada69

  • MD5

    59d10dab0637b1608a97f3e36899082e

  • SHA1

    9c8deca1189a84a8ca59d3f71da352b9f3488f2a

  • SHA256

    9dd242fda4f305662555852b45cee283b3e338207a18263c0004cb111d57766c

  • SHA512

    40cbd2c40601b4c6b3f4eeea2dd4e6880bc68ddc28ed0e097776127319451a7712e478c1f79825867f10a2e727e2fba5482cce609f7bcb13cb1391ea9789b38b

  • SSDEEP

    6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstk:BViYC3aZU53QuIjLKdwGge

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

68.187.160.28:443

97.120.32.227:80

187.188.166.192:8080

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

68.174.15.223:80

63.246.252.234:80

93.148.252.90:80

74.59.187.94:80

185.160.212.3:80

46.28.111.142:7080

183.99.239.141:80

68.129.203.162:443

144.139.56.105:80

191.183.21.190:80

81.157.234.90:8080

138.68.106.4:7080

203.130.0.69:80

rsa_pubkey.plain

Targets

    • Target

      59d10dab0637b1608a97f3e36899082e_JaffaCakes118

    • Size

      312KB

    • MD5

      59d10dab0637b1608a97f3e36899082e

    • SHA1

      9c8deca1189a84a8ca59d3f71da352b9f3488f2a

    • SHA256

      9dd242fda4f305662555852b45cee283b3e338207a18263c0004cb111d57766c

    • SHA512

      40cbd2c40601b4c6b3f4eeea2dd4e6880bc68ddc28ed0e097776127319451a7712e478c1f79825867f10a2e727e2fba5482cce609f7bcb13cb1391ea9789b38b

    • SSDEEP

      6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstk:BViYC3aZU53QuIjLKdwGge

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks