General

  • Target

    75920305117edcb3ef056d66a987a0ae_JaffaCakes118

  • Size

    572KB

  • Sample

    240526-qbse9afh46

  • MD5

    75920305117edcb3ef056d66a987a0ae

  • SHA1

    d090b9af29f0f39846a5eab0b0ca9995ac7604da

  • SHA256

    cdb902700e61492274986dfec0575fb347c92c9166284f9bee38012f0d298386

  • SHA512

    6a8b92940a0bfc0b038a5a0eb46f00e465e7f5809de92c59426a90ca13eda344560714e0e96bad025bce8d3e8aae4da89b0692f851869979af8972d2710e3c39

  • SSDEEP

    6144:SoTAnGr0COJgW/U1nzbi2LU471dwyw63V4bSW6KRLAaB+jt9bRNp:dPr9GYPiwNFxV4o6LL6j

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.186.191.177:80

91.242.138.5:80

173.13.135.102:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

80.11.163.139:21

182.176.132.213:8090

165.227.156.155:443

118.201.230.249:80

138.201.140.110:8080

46.105.131.87:80

87.106.139.101:8080

24.45.193.161:7080

209.97.168.52:8080

190.12.119.180:443

190.147.215.53:22

191.92.209.110:7080

91.205.215.66:8080

rsa_pubkey.plain

Targets

    • Target

      75920305117edcb3ef056d66a987a0ae_JaffaCakes118

    • Size

      572KB

    • MD5

      75920305117edcb3ef056d66a987a0ae

    • SHA1

      d090b9af29f0f39846a5eab0b0ca9995ac7604da

    • SHA256

      cdb902700e61492274986dfec0575fb347c92c9166284f9bee38012f0d298386

    • SHA512

      6a8b92940a0bfc0b038a5a0eb46f00e465e7f5809de92c59426a90ca13eda344560714e0e96bad025bce8d3e8aae4da89b0692f851869979af8972d2710e3c39

    • SSDEEP

      6144:SoTAnGr0COJgW/U1nzbi2LU471dwyw63V4bSW6KRLAaB+jt9bRNp:dPr9GYPiwNFxV4o6LL6j

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks