General

  • Target

    824960266ab006cea84f7ac5f5b943fe_JaffaCakes118

  • Size

    352KB

  • Sample

    240529-26wa6sdd8z

  • MD5

    824960266ab006cea84f7ac5f5b943fe

  • SHA1

    3fdc766ed34b50f2d1413767c556116f249bb62b

  • SHA256

    db320d90f0e5690effccfdd333e1e63a5f398fea49583a84027eb755e4ed4382

  • SHA512

    4c76c16da19254c6a422ce283510dec584475297aace3ab02137925bed21db31aa355891d687492bb2cdc979518daa65cb0601769613029c94edc71e3a05592d

  • SSDEEP

    6144:br35s1zzboAjvYQNqcZpGXMbtQ4op838ignX3o0CIKAIEpO4:br5sJboSwQNziMA8OnXY0eAIEo4

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

50.63.13.135:8080

80.211.32.88:8080

222.239.249.166:443

54.38.94.197:8080

78.46.87.133:8080

191.100.24.201:50000

200.71.112.158:53

212.129.14.27:8080

190.189.79.73:80

176.58.93.123:80

113.52.135.33:7080

161.18.233.114:80

46.17.6.116:8080

192.241.220.183:8080

162.144.46.90:8080

95.216.207.86:7080

95.216.212.157:8080

217.26.163.82:7080

50.116.78.109:8080

142.93.87.198:8080

rsa_pubkey.plain

Targets

    • Target

      824960266ab006cea84f7ac5f5b943fe_JaffaCakes118

    • Size

      352KB

    • MD5

      824960266ab006cea84f7ac5f5b943fe

    • SHA1

      3fdc766ed34b50f2d1413767c556116f249bb62b

    • SHA256

      db320d90f0e5690effccfdd333e1e63a5f398fea49583a84027eb755e4ed4382

    • SHA512

      4c76c16da19254c6a422ce283510dec584475297aace3ab02137925bed21db31aa355891d687492bb2cdc979518daa65cb0601769613029c94edc71e3a05592d

    • SSDEEP

      6144:br35s1zzboAjvYQNqcZpGXMbtQ4op838ignX3o0CIKAIEpO4:br5sJboSwQNziMA8OnXY0eAIEo4

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks