General

  • Target

    82a50e3e5a57d26fb523858706d5d9e6_JaffaCakes118

  • Size

    648KB

  • Sample

    240530-btqbaahe3v

  • MD5

    82a50e3e5a57d26fb523858706d5d9e6

  • SHA1

    d6f481f8d8f5a69e9c726936179d2e3a828e228a

  • SHA256

    5c15f49de59c99c424e8d05bfd74e5fd89a8a517dfe43ef445a503f643e67c92

  • SHA512

    b7c6526ccfc729f35f5a116bdaa0fc0607902d73ba5363404d710d502283e4b74b2b25314817d42f06c670ec292af3f0c34bf890b64e8646b36920a1e8cb8665

  • SSDEEP

    6144:2GlraQJnciJEGqVciHipSamKMt9aHJCwwcvSrCAfWde8kTLGNkBS1vSFh2hX2eIM:jTcimciHxzWwc6rCAfJpSQh2ZIy

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

76.168.54.203:80

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

5.196.35.138:7080

177.129.17.170:443

87.106.46.107:8080

68.183.190.199:8080

185.183.16.47:80

186.103.141.250:443

64.201.88.132:80

70.32.84.74:8080

68.69.155.181:80

82.76.111.249:443

111.67.12.221:8080

60.93.23.51:80

104.131.41.185:8080

92.24.50.153:80

191.182.6.118:80

61.197.92.216:80

rsa_pubkey.plain

Targets

    • Target

      82a50e3e5a57d26fb523858706d5d9e6_JaffaCakes118

    • Size

      648KB

    • MD5

      82a50e3e5a57d26fb523858706d5d9e6

    • SHA1

      d6f481f8d8f5a69e9c726936179d2e3a828e228a

    • SHA256

      5c15f49de59c99c424e8d05bfd74e5fd89a8a517dfe43ef445a503f643e67c92

    • SHA512

      b7c6526ccfc729f35f5a116bdaa0fc0607902d73ba5363404d710d502283e4b74b2b25314817d42f06c670ec292af3f0c34bf890b64e8646b36920a1e8cb8665

    • SSDEEP

      6144:2GlraQJnciJEGqVciHipSamKMt9aHJCwwcvSrCAfWde8kTLGNkBS1vSFh2hX2eIM:jTcimciHxzWwc6rCAfJpSQh2ZIy

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks