General

  • Target

    6460ba70c8fcebef2e34fe04e8f26c46_JaffaCakes118

  • Size

    745KB

  • Sample

    240521-xhamcaeg47

  • MD5

    6460ba70c8fcebef2e34fe04e8f26c46

  • SHA1

    4802926f2471dd7165eda93d9b816f2209fe4a2b

  • SHA256

    4a8d4ea6f311c7acf3e04c483ab7eb77b5e3de03ca4d15eed503617dc85c19d9

  • SHA512

    ba5373c37db21d7d6f5b609414c8c2d3f61e2e460b1002c18de00fce3329432ab78a8b3fd35a99a7c701a746c07527d82672d7cc37c1364d79f42e63493a2df9

  • SSDEEP

    12288:X1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2n6lT0O3lA:X1iuUXAQK8ulSbGvUntbyYVcdYL6

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

66.229.161.86:443

190.47.236.83:80

217.12.70.226:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

95.216.207.86:7080

128.92.54.20:80

185.192.75.240:443

41.77.74.214:443

190.38.252.45:443

124.150.175.129:8080

191.100.24.201:50000

178.134.1.238:80

72.51.153.27:80

210.224.65.117:80

83.156.88.159:80

190.171.135.235:80

100.38.11.243:80

rsa_pubkey.plain

Targets

    • Target

      6460ba70c8fcebef2e34fe04e8f26c46_JaffaCakes118

    • Size

      745KB

    • MD5

      6460ba70c8fcebef2e34fe04e8f26c46

    • SHA1

      4802926f2471dd7165eda93d9b816f2209fe4a2b

    • SHA256

      4a8d4ea6f311c7acf3e04c483ab7eb77b5e3de03ca4d15eed503617dc85c19d9

    • SHA512

      ba5373c37db21d7d6f5b609414c8c2d3f61e2e460b1002c18de00fce3329432ab78a8b3fd35a99a7c701a746c07527d82672d7cc37c1364d79f42e63493a2df9

    • SSDEEP

      12288:X1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2n6lT0O3lA:X1iuUXAQK8ulSbGvUntbyYVcdYL6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks