General

  • Target

    5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118

  • Size

    380KB

  • Sample

    240520-enwsnabe5w

  • MD5

    5d17e134d24edaeb3fe5e3937b502843

  • SHA1

    600c5e9971a376a99e4528f4261aa207b24a2303

  • SHA256

    834c2ad4ab0a0024b885975208847ba04beb4274944d0014e9823361747411f0

  • SHA512

    f896bbdf4728efb64f04cddc79ed15a792d8b5d30d4d6761d19bad5ee8ff75e94647e82aaa0f33cd88900725b5dd3ccdf5de1b32e990cc66833878723cfa42fc

  • SSDEEP

    3072:KJFSZujJRF9CwQEp4JiTLZ+1mEu/l/Jp3SufIDL1Mf6js9Cv/4OL3IHGJRJ:KJFScLF40+Zu/l/jSufIZMSAogOLbB

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

107.170.27.84:443

85.234.143.94:8080

204.225.249.100:8080

173.212.220.251:443

60.54.37.25:80

178.249.187.151:8080

91.83.93.124:7080

77.245.101.134:8080

68.183.190.199:8080

203.25.159.3:8080

41.75.135.93:7080

46.28.111.142:7080

163.172.40.218:7080

45.79.95.107:443

181.198.203.45:443

185.86.148.222:8080

181.231.62.54:80

186.23.132.93:990

46.29.183.211:8080

62.75.143.100:7080

rsa_pubkey.plain

Targets

    • Target

      5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118

    • Size

      380KB

    • MD5

      5d17e134d24edaeb3fe5e3937b502843

    • SHA1

      600c5e9971a376a99e4528f4261aa207b24a2303

    • SHA256

      834c2ad4ab0a0024b885975208847ba04beb4274944d0014e9823361747411f0

    • SHA512

      f896bbdf4728efb64f04cddc79ed15a792d8b5d30d4d6761d19bad5ee8ff75e94647e82aaa0f33cd88900725b5dd3ccdf5de1b32e990cc66833878723cfa42fc

    • SSDEEP

      3072:KJFSZujJRF9CwQEp4JiTLZ+1mEu/l/Jp3SufIDL1Mf6js9Cv/4OL3IHGJRJ:KJFScLF40+Zu/l/jSufIZMSAogOLbB

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks