General

  • Target

    6313964963b4091ee8b6699234041173_JaffaCakes118

  • Size

    596KB

  • Sample

    240521-m8d3cabc87

  • MD5

    6313964963b4091ee8b6699234041173

  • SHA1

    76f5dc306b781808c7c7903fca302073b2c5fef7

  • SHA256

    67cda97e97e32f358b42f2546eb5f9e8b1273f857dea2effca381d1974d9b498

  • SHA512

    262bf3faf6bdda4180664d030444802f4703b6733fddfaad18201e6c136051f35822e57ca08e6afee40310e997446681fa8195eacde471ae3e08763ffef70d43

  • SSDEEP

    12288:zG010b+sx/rXfjqeVBbGZw50QnXmxDKdiyqB:8brx/7We/asmtKG

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

211.218.105.101:80

197.90.159.42:80

201.183.251.100:80

50.63.13.135:8080

80.211.32.88:8080

222.239.249.166:443

192.161.190.171:8080

161.18.233.114:80

41.218.118.66:80

189.236.4.214:443

181.197.108.171:443

80.93.48.49:7080

212.129.14.27:8080

78.46.87.133:8080

200.71.112.158:53

216.75.37.196:8080

157.7.164.178:8081

195.201.56.68:7080

189.180.105.125:443

124.150.175.129:8080

rsa_pubkey.plain

Targets

    • Target

      6313964963b4091ee8b6699234041173_JaffaCakes118

    • Size

      596KB

    • MD5

      6313964963b4091ee8b6699234041173

    • SHA1

      76f5dc306b781808c7c7903fca302073b2c5fef7

    • SHA256

      67cda97e97e32f358b42f2546eb5f9e8b1273f857dea2effca381d1974d9b498

    • SHA512

      262bf3faf6bdda4180664d030444802f4703b6733fddfaad18201e6c136051f35822e57ca08e6afee40310e997446681fa8195eacde471ae3e08763ffef70d43

    • SSDEEP

      12288:zG010b+sx/rXfjqeVBbGZw50QnXmxDKdiyqB:8brx/7We/asmtKG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks