General

  • Target

    6f9ea7ac8dedf20d3480fa54257daeaf_JaffaCakes118

  • Size

    145KB

  • Sample

    240524-yca7csha64

  • MD5

    6f9ea7ac8dedf20d3480fa54257daeaf

  • SHA1

    6eb40fea11df2aa830c887805092537ad8063907

  • SHA256

    8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd

  • SHA512

    00c5f8a3e9d00af550f2ab9fc4a5960c93dc6f4ab51667de482e497c2b019095eb7ddee225d7d44e8527b29508897c9c0cc90ffb15a24c617671f1b0be994da3

  • SSDEEP

    3072:kyYIilXVCZV4xqbqP1AjTPsjuHY17UycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHsbKOo9EdAPXPZLGGarmG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

91.105.94.200:80

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

189.2.177.210:443

181.30.61.163:443

185.178.10.77:80

199.203.62.165:80

177.73.0.98:443

87.106.46.107:8080

5.196.35.138:7080

5.189.178.202:8080

185.183.16.47:80

78.249.119.122:80

191.182.6.118:80

96.227.52.8:443

186.103.141.250:443

50.28.51.143:8080

111.67.12.221:8080

50.121.220.50:80

rsa_pubkey.plain

Targets

    • Target

      6f9ea7ac8dedf20d3480fa54257daeaf_JaffaCakes118

    • Size

      145KB

    • MD5

      6f9ea7ac8dedf20d3480fa54257daeaf

    • SHA1

      6eb40fea11df2aa830c887805092537ad8063907

    • SHA256

      8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd

    • SHA512

      00c5f8a3e9d00af550f2ab9fc4a5960c93dc6f4ab51667de482e497c2b019095eb7ddee225d7d44e8527b29508897c9c0cc90ffb15a24c617671f1b0be994da3

    • SSDEEP

      3072:kyYIilXVCZV4xqbqP1AjTPsjuHY17UycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHsbKOo9EdAPXPZLGGarmG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks