General

  • Target

    63f5ca92fa7dd38734c9bb07f5fc8d5d_JaffaCakes118

  • Size

    428KB

  • Sample

    240521-tyxv2abf84

  • MD5

    63f5ca92fa7dd38734c9bb07f5fc8d5d

  • SHA1

    8a875f04592659b55679d1032b8b8d03a23531ed

  • SHA256

    1f6d82c832e2e635748534286e69bcbb86a75ae6fcf3f1a3c1c516e879b0f45d

  • SHA512

    05ba8405304100cb358ccbea97a8841aca38e0b54d3894de03e49eaa86a008d4f6b28a1818fbfa21bf75aa4434b532522cb7d582dfa742b7ab9c7f8784541054

  • SSDEEP

    12288:561KBnflNHOvmzIeCHgw3/qJd60gmoP1jjv08/adpUu:56wXCp3/qJd60gmoP1jjv08/ipUu

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

24.249.135.121:80

185.94.252.13:443

149.62.173.247:8080

50.28.51.143:8080

80.249.176.206:80

5.196.35.138:7080

190.17.195.202:80

143.0.87.101:80

190.147.137.153:443

181.30.69.50:80

51.255.165.160:8080

190.96.118.251:443

72.47.248.48:7080

178.79.163.131:8080

212.231.60.98:80

187.162.248.237:80

2.47.112.152:80

68.183.190.199:8080

192.241.143.52:8080

77.55.211.77:8080

rsa_pubkey.plain

Targets

    • Target

      63f5ca92fa7dd38734c9bb07f5fc8d5d_JaffaCakes118

    • Size

      428KB

    • MD5

      63f5ca92fa7dd38734c9bb07f5fc8d5d

    • SHA1

      8a875f04592659b55679d1032b8b8d03a23531ed

    • SHA256

      1f6d82c832e2e635748534286e69bcbb86a75ae6fcf3f1a3c1c516e879b0f45d

    • SHA512

      05ba8405304100cb358ccbea97a8841aca38e0b54d3894de03e49eaa86a008d4f6b28a1818fbfa21bf75aa4434b532522cb7d582dfa742b7ab9c7f8784541054

    • SSDEEP

      12288:561KBnflNHOvmzIeCHgw3/qJd60gmoP1jjv08/adpUu:56wXCp3/qJd60gmoP1jjv08/ipUu

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks