General

  • Target

    5ecb76de592efcf16cad8877bba810b0_JaffaCakes118

  • Size

    864KB

  • Sample

    240520-ne4xcahg7x

  • MD5

    5ecb76de592efcf16cad8877bba810b0

  • SHA1

    25df43a24c58803679411975f8f24149024d181c

  • SHA256

    f8452a0aa99d6919b18c26495babd0c299fce7ffcca6f3beddefb8243f5ee85b

  • SHA512

    9b80838a19ec7979c6a3fbe6c3130dc479f40a8f2247ab3869f6a9798a2de4504ebec2b9f3a3784fbe97cd0b79546537d5344b33960e4b2cf07ebdc5672a001b

  • SSDEEP

    12288:qm7T56Fa9GVjnSy64Vkj8cxFGWMnKHWMtlCRXB:Z7TIFQQj3ri8DWMnKHWMtlCRR

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain

Targets

    • Target

      5ecb76de592efcf16cad8877bba810b0_JaffaCakes118

    • Size

      864KB

    • MD5

      5ecb76de592efcf16cad8877bba810b0

    • SHA1

      25df43a24c58803679411975f8f24149024d181c

    • SHA256

      f8452a0aa99d6919b18c26495babd0c299fce7ffcca6f3beddefb8243f5ee85b

    • SHA512

      9b80838a19ec7979c6a3fbe6c3130dc479f40a8f2247ab3869f6a9798a2de4504ebec2b9f3a3784fbe97cd0b79546537d5344b33960e4b2cf07ebdc5672a001b

    • SSDEEP

      12288:qm7T56Fa9GVjnSy64Vkj8cxFGWMnKHWMtlCRXB:Z7TIFQQj3ri8DWMnKHWMtlCRR

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks