General

  • Target

    6d167b269b3c9dc976cf1d21ce56eee4_JaffaCakes118

  • Size

    700KB

  • Sample

    240524-c73n7sae33

  • MD5

    6d167b269b3c9dc976cf1d21ce56eee4

  • SHA1

    f170b7f85bd692f4948b86e5c5abce2a9d5fdecd

  • SHA256

    0e34c4871d09b127e047326bf77d8d3af7edf87aa3b2cff1cca1f7c87c14c269

  • SHA512

    5ea7a33a03ed10960b3c7eed1b083d375dc744ef3db1f8724f1dedfd77d47b27f2fafc268c09b82ddd28630cb031bd2e1e1a07b4b9bc1badcf10866428cb304d

  • SSDEEP

    12288:fyXMU1e35mT4PfLy0+mS7i+x/v4qcyFuNV3dn:cMV3ATe+0adxzuXt

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.176.19.218:80

66.76.63.99:80

100.14.117.137:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

176.106.183.253:8080

31.172.240.91:8080

139.130.241.252:443

188.152.7.140:80

110.142.38.16:80

200.71.148.138:8080

87.106.139.101:8080

91.187.80.246:80

195.244.215.206:80

93.147.141.5:80

104.131.11.150:8080

104.236.246.93:8080

181.57.193.14:80

rsa_pubkey.plain

Targets

    • Target

      6d167b269b3c9dc976cf1d21ce56eee4_JaffaCakes118

    • Size

      700KB

    • MD5

      6d167b269b3c9dc976cf1d21ce56eee4

    • SHA1

      f170b7f85bd692f4948b86e5c5abce2a9d5fdecd

    • SHA256

      0e34c4871d09b127e047326bf77d8d3af7edf87aa3b2cff1cca1f7c87c14c269

    • SHA512

      5ea7a33a03ed10960b3c7eed1b083d375dc744ef3db1f8724f1dedfd77d47b27f2fafc268c09b82ddd28630cb031bd2e1e1a07b4b9bc1badcf10866428cb304d

    • SSDEEP

      12288:fyXMU1e35mT4PfLy0+mS7i+x/v4qcyFuNV3dn:cMV3ATe+0adxzuXt

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks