General

  • Target

    8143d35d00f10c6edece5e330c60df48_JaffaCakes118

  • Size

    65KB

  • Sample

    240529-tdvvyabb4t

  • MD5

    8143d35d00f10c6edece5e330c60df48

  • SHA1

    7a8d9fca37941d38548ce8192874def40b8ac3f9

  • SHA256

    eb0db7d61c39e5b4e9fdf813a78f91b7ba8bb7a0513fbe89a0339811b2f4a689

  • SHA512

    959131fea75a80a973583ca0d995190fed9118d239dfd1bfa6c45ca7b2d0ae4cc15702062b859433debf4d44599b9b0b068886806200cd1381357d4503840fbf

  • SSDEEP

    1536:1E1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+uL:mLjsXANkR/fkfdWolI9AiDfL

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

14.160.93.230:80

144.139.158.155:80

46.29.183.211:8080

23.229.115.217:8080

81.169.140.14:443

186.0.95.172:80

91.205.215.57:7080

201.163.74.202:443

5.196.35.138:7080

91.204.163.19:8090

86.42.166.147:80

200.58.83.179:80

181.59.253.20:21

46.101.212.195:8080

91.83.93.124:7080

68.183.170.114:8080

190.10.194.42:8080

190.230.60.129:8080

77.55.211.77:8080

220.241.38.226:50000

rsa_pubkey.plain

Targets

    • Target

      8143d35d00f10c6edece5e330c60df48_JaffaCakes118

    • Size

      65KB

    • MD5

      8143d35d00f10c6edece5e330c60df48

    • SHA1

      7a8d9fca37941d38548ce8192874def40b8ac3f9

    • SHA256

      eb0db7d61c39e5b4e9fdf813a78f91b7ba8bb7a0513fbe89a0339811b2f4a689

    • SHA512

      959131fea75a80a973583ca0d995190fed9118d239dfd1bfa6c45ca7b2d0ae4cc15702062b859433debf4d44599b9b0b068886806200cd1381357d4503840fbf

    • SSDEEP

      1536:1E1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+uL:mLjsXANkR/fkfdWolI9AiDfL

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks