General

  • Target

    75f84e04b64198dd207a8d7d29e7a6cc_JaffaCakes118

  • Size

    156KB

  • Sample

    240526-s53jescd25

  • MD5

    75f84e04b64198dd207a8d7d29e7a6cc

  • SHA1

    eae0f3ae1266dd56ff5f70e5982d5f3caef6a817

  • SHA256

    69501729b2461e10fab792b79df49a9eeaa98216eb66fdecd1c6439e108e8e50

  • SHA512

    79c489e9184bb09514e04f3e0b89126d2cc3673feef68a4a3ca014d005c0bfd758c0f17cdc26ed1d6b9097dcf61a5cc2639b9c8886501c3d2ba86744256e0b5d

  • SSDEEP

    3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFne7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wnesgmj

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

50.121.220.50:80

51.75.33.122:80

54.37.42.48:8080

91.121.54.71:8080

83.169.21.32:7080

68.69.155.181:80

67.247.242.247:80

213.197.182.158:8080

45.173.88.33:80

111.67.12.221:8080

217.13.106.14:8080

191.99.160.58:80

178.148.55.236:8080

85.109.159.61:443

110.142.219.51:80

50.28.51.143:8080

77.90.136.129:8080

209.236.123.42:8080

72.135.200.124:80

184.66.18.83:80

rsa_pubkey.plain

Targets

    • Target

      75f84e04b64198dd207a8d7d29e7a6cc_JaffaCakes118

    • Size

      156KB

    • MD5

      75f84e04b64198dd207a8d7d29e7a6cc

    • SHA1

      eae0f3ae1266dd56ff5f70e5982d5f3caef6a817

    • SHA256

      69501729b2461e10fab792b79df49a9eeaa98216eb66fdecd1c6439e108e8e50

    • SHA512

      79c489e9184bb09514e04f3e0b89126d2cc3673feef68a4a3ca014d005c0bfd758c0f17cdc26ed1d6b9097dcf61a5cc2639b9c8886501c3d2ba86744256e0b5d

    • SSDEEP

      3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFne7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wnesgmj

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks