General

  • Target

    6f0e29a40b8fe4e72e213df6cd6542b3_JaffaCakes118

  • Size

    287KB

  • Sample

    240524-td5p5sbf32

  • MD5

    6f0e29a40b8fe4e72e213df6cd6542b3

  • SHA1

    853af46cdd182f06f67e5b369735905d57bae6c1

  • SHA256

    70b41b2769fccfffef2eb5590674737ccfa8f73adeb750cf54e330eed633c75e

  • SHA512

    0b5ea8e3f51244139bd4af5230b2a9db394cb8a406180bf183ba9d9b10f49a9251073515f91ee0f739cc547f18b22807dd56e4d52982cd9e69ddfa158af90ec7

  • SSDEEP

    6144:n5NeJNQUnrdBFA7u3BncB0lpPW6I/Y9abCcpKAGJ6goqvUt4lM:2BcB0PPWl/Y9ab8AG5oqvlM

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

107.170.27.84:443

85.234.143.94:8080

204.225.249.100:8080

173.212.220.251:443

60.54.37.25:80

178.249.187.151:8080

91.83.93.124:7080

77.245.101.134:8080

68.183.190.199:8080

203.25.159.3:8080

41.75.135.93:7080

46.28.111.142:7080

163.172.40.218:7080

45.79.95.107:443

181.198.203.45:443

185.86.148.222:8080

181.231.62.54:80

186.23.132.93:990

46.29.183.211:8080

62.75.143.100:7080

rsa_pubkey.plain

Targets

    • Target

      6f0e29a40b8fe4e72e213df6cd6542b3_JaffaCakes118

    • Size

      287KB

    • MD5

      6f0e29a40b8fe4e72e213df6cd6542b3

    • SHA1

      853af46cdd182f06f67e5b369735905d57bae6c1

    • SHA256

      70b41b2769fccfffef2eb5590674737ccfa8f73adeb750cf54e330eed633c75e

    • SHA512

      0b5ea8e3f51244139bd4af5230b2a9db394cb8a406180bf183ba9d9b10f49a9251073515f91ee0f739cc547f18b22807dd56e4d52982cd9e69ddfa158af90ec7

    • SSDEEP

      6144:n5NeJNQUnrdBFA7u3BncB0lpPW6I/Y9abCcpKAGJ6goqvUt4lM:2BcB0PPWl/Y9ab8AG5oqvlM

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks