General

  • Target

    789276feab6849023a6c4b6a11861ea8_JaffaCakes118

  • Size

    412KB

  • Sample

    240527-kqgz6sfa85

  • MD5

    789276feab6849023a6c4b6a11861ea8

  • SHA1

    050647db9bc42a11ccfb2e0b130e875750c2b89b

  • SHA256

    2432483d736e2ecf5e4e6c4a9289abee9c8f32250b5e26dc8733a76f7a144575

  • SHA512

    65825be8a021eb55abf2017fbd537391942d0d0d4841eb4dbb33a9b399134f86df93c4034b1d23c8cc94cadf6b468ee335fa27ae0ddb2102326b135aa60c86f5

  • SSDEEP

    6144:EvF5YL75Xe42xSCSuwxrSFfsezX96mmK7HU7msXI1jA3d/rv1eK2X:EvF5m7Je42xj3ISX9JHU7U0rIKs

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.92.11.143:8080

200.30.227.135:80

178.249.187.151:8080

81.169.140.14:443

94.177.183.28:8080

89.188.124.145:443

185.86.148.222:8080

82.196.15.205:8080

77.245.101.134:8080

217.199.160.224:8080

76.69.29.42:80

181.59.253.20:21

46.28.111.142:7080

149.62.173.247:8080

200.58.83.179:80

190.230.60.129:80

181.36.42.205:443

190.97.30.167:990

46.29.183.211:8080

87.106.77.40:7080

rsa_pubkey.plain

Targets

    • Target

      789276feab6849023a6c4b6a11861ea8_JaffaCakes118

    • Size

      412KB

    • MD5

      789276feab6849023a6c4b6a11861ea8

    • SHA1

      050647db9bc42a11ccfb2e0b130e875750c2b89b

    • SHA256

      2432483d736e2ecf5e4e6c4a9289abee9c8f32250b5e26dc8733a76f7a144575

    • SHA512

      65825be8a021eb55abf2017fbd537391942d0d0d4841eb4dbb33a9b399134f86df93c4034b1d23c8cc94cadf6b468ee335fa27ae0ddb2102326b135aa60c86f5

    • SSDEEP

      6144:EvF5YL75Xe42xSCSuwxrSFfsezX96mmK7HU7msXI1jA3d/rv1eK2X:EvF5m7Je42xj3ISX9JHU7U0rIKs

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks