General

  • Target

    7a1eb469e7770165d1229a974c1dc5ae_JaffaCakes118

  • Size

    492KB

  • Sample

    240527-xaq95ade91

  • MD5

    7a1eb469e7770165d1229a974c1dc5ae

  • SHA1

    6073ddec655c8d8b058c88b53fdc5a8f3ac57f5b

  • SHA256

    f1903df3ba4f10a826ca7f2e1cdf2573442a00073723ff4f416949ceb8a3b1c1

  • SHA512

    d55cc6ab6f434cf7813b32360901af9916a6f5bd492648f943fe3605f51e8be863875678160c05e9f14662d5bca596a6fd16cab184913a4641c93580fc0b68c4

  • SSDEEP

    6144:74Nu8fk4Q8EykWWokq4s4jXNi/5/k/fMllZGtBaFOg4mUdfEtfF2iOETogGjcKE7:74NFfk4QYkWWNqwjmkeYOMiyjcsa40r

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

47.146.42.234:80

130.45.45.31:80

200.119.11.118:443

96.126.121.64:443

104.236.137.72:8080

172.104.233.225:8080

85.234.143.94:8080

91.205.215.57:7080

62.75.160.178:8080

45.79.95.107:443

190.195.129.227:8090

159.203.204.126:8080

181.36.42.205:443

186.68.48.204:443

14.160.93.230:80

119.59.124.163:8080

87.118.70.69:8080

5.196.35.138:7080

82.8.232.51:80

203.130.0.69:80

rsa_pubkey.plain

Targets

    • Target

      7a1eb469e7770165d1229a974c1dc5ae_JaffaCakes118

    • Size

      492KB

    • MD5

      7a1eb469e7770165d1229a974c1dc5ae

    • SHA1

      6073ddec655c8d8b058c88b53fdc5a8f3ac57f5b

    • SHA256

      f1903df3ba4f10a826ca7f2e1cdf2573442a00073723ff4f416949ceb8a3b1c1

    • SHA512

      d55cc6ab6f434cf7813b32360901af9916a6f5bd492648f943fe3605f51e8be863875678160c05e9f14662d5bca596a6fd16cab184913a4641c93580fc0b68c4

    • SSDEEP

      6144:74Nu8fk4Q8EykWWokq4s4jXNi/5/k/fMllZGtBaFOg4mUdfEtfF2iOETogGjcKE7:74NFfk4QYkWWNqwjmkeYOMiyjcsa40r

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks