General

  • Target

    72ac7e6734b644fd996aa9c9374ac06f_JaffaCakes118

  • Size

    160KB

  • Sample

    240525-vrl1mabe6s

  • MD5

    72ac7e6734b644fd996aa9c9374ac06f

  • SHA1

    cf0bb124a01ccd0e159846763021369427ab6584

  • SHA256

    32c4035efdd3f6f71b09c28e2a75122d19d1206b83fad5a93ddbc013b9275f94

  • SHA512

    51734cb0765585188e9284dce0b3b2b1af7f279aa857de9101bfdcdbbe9b288fe02d64e0821ce513df35143a0e02c1aaeb14fc447ec764a8ed81ef53883b4922

  • SSDEEP

    3072:IRMxtgIrpwUMuh+SlId2ccld5b2IOIQlNtGZknCBNZHAr9BnZfp/adi:TxtU8Md2ccld5b2IOIQlNtGZknC/NAbU

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

137.119.36.33:80

116.202.234.183:8080

69.30.203.214:8080

204.197.146.48:80

87.106.136.232:8080

153.163.83.106:80

91.211.88.52:7080

93.147.212.206:80

222.214.218.37:4143

189.212.199.126:443

203.153.216.189:7080

83.169.36.251:8080

188.83.220.2:443

104.236.246.93:8080

173.62.217.22:443

5.196.74.210:8080

68.188.112.97:80

139.130.242.43:80

61.19.246.238:443

24.179.13.119:80

rsa_pubkey.plain

Targets

    • Target

      72ac7e6734b644fd996aa9c9374ac06f_JaffaCakes118

    • Size

      160KB

    • MD5

      72ac7e6734b644fd996aa9c9374ac06f

    • SHA1

      cf0bb124a01ccd0e159846763021369427ab6584

    • SHA256

      32c4035efdd3f6f71b09c28e2a75122d19d1206b83fad5a93ddbc013b9275f94

    • SHA512

      51734cb0765585188e9284dce0b3b2b1af7f279aa857de9101bfdcdbbe9b288fe02d64e0821ce513df35143a0e02c1aaeb14fc447ec764a8ed81ef53883b4922

    • SSDEEP

      3072:IRMxtgIrpwUMuh+SlId2ccld5b2IOIQlNtGZknCBNZHAr9BnZfp/adi:TxtU8Md2ccld5b2IOIQlNtGZknC/NAbU

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks