General

  • Target

    6b87d169f7a89f751cec1e7da5617b1e_JaffaCakes118

  • Size

    172KB

  • Sample

    240523-ts28kagg7x

  • MD5

    6b87d169f7a89f751cec1e7da5617b1e

  • SHA1

    b17ce98b7fbcd5fc57a430d1a7bbec73115352cf

  • SHA256

    2ba83757239f83a9cf9acb50dbec3c6640e51f9830b248deecf3f3df2ca78a85

  • SHA512

    725ac831b95d0b1dffa6b2f8c6cc49dd703b1dad4b8232b5b493099b6c28839193640713fd6c4a1603e0637d6547dde3a682bdf58b964eeabb1719f7f516cc2f

  • SSDEEP

    3072:WrrsAIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrbIL8/Xatd54AddF8

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

223.133.20.171:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

58.27.215.3:8080

220.147.247.145:80

139.59.12.63:8080

185.142.236.163:443

113.156.82.32:80

126.126.139.26:443

198.57.203.63:8080

181.137.229.1:80

95.216.205.155:8080

37.187.100.220:7080

50.116.78.109:8080

37.205.9.252:7080

172.105.78.244:8080

103.133.66.57:443

91.75.75.46:80

46.105.131.68:8080

rsa_pubkey.plain

Targets

    • Target

      6b87d169f7a89f751cec1e7da5617b1e_JaffaCakes118

    • Size

      172KB

    • MD5

      6b87d169f7a89f751cec1e7da5617b1e

    • SHA1

      b17ce98b7fbcd5fc57a430d1a7bbec73115352cf

    • SHA256

      2ba83757239f83a9cf9acb50dbec3c6640e51f9830b248deecf3f3df2ca78a85

    • SHA512

      725ac831b95d0b1dffa6b2f8c6cc49dd703b1dad4b8232b5b493099b6c28839193640713fd6c4a1603e0637d6547dde3a682bdf58b964eeabb1719f7f516cc2f

    • SSDEEP

      3072:WrrsAIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrbIL8/Xatd54AddF8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks