General

  • Target

    6c19e1b4e91e3437d0b3484b572683da_JaffaCakes118

  • Size

    360KB

  • Sample

    240523-ythb1aee77

  • MD5

    6c19e1b4e91e3437d0b3484b572683da

  • SHA1

    057bb50a0de6d209bb6fe0df727607c743d6182b

  • SHA256

    cb09c9a80c4a399335c22ece90dc9a6f28a1fae7f23d95871d41fab59b0fa6af

  • SHA512

    b6030a7c603ab6f59f5327d7eb797f17513a05e3100d0622b02d7cc9b827fd84a20cea04529af0c611996461b2e6ae46a2f37cf99ad97e79a74bc3308e724fb4

  • SSDEEP

    6144:Ukps/EJxl4tfji9K/9AFnXQkT2r+t0ooMSuFjNw4VyJ6uhjqk:UkpsClQLMK/qXQkT2r+tFVSuHVyFF

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

162.249.220.190:80

85.25.207.108:8080

178.128.14.92:8080

50.116.78.109:8080

181.113.229.139:443

192.241.220.183:8080

203.153.216.178:7080

177.32.8.85:80

139.99.157.213:8080

31.146.61.34:80

192.210.217.94:8080

188.251.213.180:443

185.208.226.142:8080

198.57.203.63:8080

220.254.198.228:443

201.213.177.139:80

197.221.158.162:80

95.216.205.155:8080

177.94.227.143:80

115.78.11.155:80

rsa_pubkey.plain

Targets

    • Target

      6c19e1b4e91e3437d0b3484b572683da_JaffaCakes118

    • Size

      360KB

    • MD5

      6c19e1b4e91e3437d0b3484b572683da

    • SHA1

      057bb50a0de6d209bb6fe0df727607c743d6182b

    • SHA256

      cb09c9a80c4a399335c22ece90dc9a6f28a1fae7f23d95871d41fab59b0fa6af

    • SHA512

      b6030a7c603ab6f59f5327d7eb797f17513a05e3100d0622b02d7cc9b827fd84a20cea04529af0c611996461b2e6ae46a2f37cf99ad97e79a74bc3308e724fb4

    • SSDEEP

      6144:Ukps/EJxl4tfji9K/9AFnXQkT2r+t0ooMSuFjNw4VyJ6uhjqk:UkpsClQLMK/qXQkT2r+tFVSuHVyFF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks