General

  • Target

    7a46ae6300ee36b083ed09468f18adf2_JaffaCakes118

  • Size

    320KB

  • Sample

    240527-ybwfxafd91

  • MD5

    7a46ae6300ee36b083ed09468f18adf2

  • SHA1

    cbc78190fe2389c3b7a4d7701de3074e6cb6e236

  • SHA256

    886d04147c42accc7fed45ce59779d58adbd23f0c527615e796a142d4c3cd610

  • SHA512

    e40ab9cde168c79e6c55f97161673a4ef93e197718e2a1969468810078be090f61ac62313400751723b4b6ddbcde770981f4bc9932009e58f103f9722110cf6e

  • SSDEEP

    6144:0eTNh1u2yP0fI6QRcHdFn2yWBA53u3Phhg+dLb9VzOmhy:00Nh1u0A6QkF2pBs3uJu+dH9UIy

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

74.79.103.55:80

190.100.153.162:443

190.6.193.152:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

62.75.160.178:8080

71.76.45.83:443

14.160.93.230:80

87.106.77.40:7080

149.135.123.65:80

76.221.133.146:80

46.101.212.195:8080

91.83.93.124:7080

45.8.136.201:80

201.213.32.59:80

2.139.158.136:443

152.170.108.99:443

188.14.39.65:443

rsa_pubkey.plain

Targets

    • Target

      7a46ae6300ee36b083ed09468f18adf2_JaffaCakes118

    • Size

      320KB

    • MD5

      7a46ae6300ee36b083ed09468f18adf2

    • SHA1

      cbc78190fe2389c3b7a4d7701de3074e6cb6e236

    • SHA256

      886d04147c42accc7fed45ce59779d58adbd23f0c527615e796a142d4c3cd610

    • SHA512

      e40ab9cde168c79e6c55f97161673a4ef93e197718e2a1969468810078be090f61ac62313400751723b4b6ddbcde770981f4bc9932009e58f103f9722110cf6e

    • SSDEEP

      6144:0eTNh1u2yP0fI6QRcHdFn2yWBA53u3Phhg+dLb9VzOmhy:00Nh1u0A6QkF2pBs3uJu+dH9UIy

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks