General

  • Target

    60b9241922b7cb000f06b1e6de7e2e38_JaffaCakes118

  • Size

    104KB

  • Sample

    240520-xvd6asdc35

  • MD5

    60b9241922b7cb000f06b1e6de7e2e38

  • SHA1

    c7700b24ede845d0600a8906371307b3c0de20c3

  • SHA256

    22b47e57ec932cc678c3bec8a62c33663ef7ec5a4c604c7a52f54db8c97c1bc4

  • SHA512

    c1a391c0e1acd15fda219faae8049465f5b1c0566bf135f778141a3cc512c0fd6354f288167579194bba06833d68ec5bfd9b582dda32cb64a5489b9e148884e3

  • SSDEEP

    3072:iNOlUI7W7YEweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIyZwev5ddGNVe49M7Lm

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

115.176.16.221:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

180.26.62.115:443

179.5.118.12:80

189.160.188.97:80

5.79.70.250:8080

126.126.139.26:443

41.84.243.145:80

79.133.6.236:8080

139.59.12.63:8080

95.216.205.155:8080

45.177.120.37:8080

54.38.143.245:8080

157.7.164.178:8081

41.212.89.128:80

50.116.78.109:8080

75.127.14.170:8080

49.243.9.118:80

rsa_pubkey.plain

Targets

    • Target

      60b9241922b7cb000f06b1e6de7e2e38_JaffaCakes118

    • Size

      104KB

    • MD5

      60b9241922b7cb000f06b1e6de7e2e38

    • SHA1

      c7700b24ede845d0600a8906371307b3c0de20c3

    • SHA256

      22b47e57ec932cc678c3bec8a62c33663ef7ec5a4c604c7a52f54db8c97c1bc4

    • SHA512

      c1a391c0e1acd15fda219faae8049465f5b1c0566bf135f778141a3cc512c0fd6354f288167579194bba06833d68ec5bfd9b582dda32cb64a5489b9e148884e3

    • SSDEEP

      3072:iNOlUI7W7YEweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIyZwev5ddGNVe49M7Lm

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks