General

  • Target

    83d31e1afb0eed1dc3b834523c91cbf2_JaffaCakes118

  • Size

    172KB

  • Sample

    240530-lz9bfsef63

  • MD5

    83d31e1afb0eed1dc3b834523c91cbf2

  • SHA1

    c687bb31b5ca5a01188b36ec26a9660256370229

  • SHA256

    8588b000cfc1b52115d3da02cf493abfeaa40ab908a4a4f17796a22bb8afcdc9

  • SHA512

    f1cb615a0b8232e821ee4c31a6d7e47bc99ab615b8bb7b468c598adc9f1106ecf48116fc492ff6661f669b67e8f2cd694d33f9912d088a5d0db48ae71b4808d9

  • SSDEEP

    1536:SvrrLwNwOTkX8CsVTC/8z/20X6AV8EiOpOACFsyfP292RiWV0IFT5mDzsoErpYj/:irLs2sL9C/sjzTT/shO9wT3F96OvOQ6

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

82.230.1.24:80

51.38.124.206:80

82.196.15.205:8080

38.88.126.202:8080

61.197.92.216:80

217.199.160.224:7080

61.92.159.208:8080

186.103.141.250:443

104.131.41.185:8080

170.81.48.2:80

50.121.220.50:80

190.195.129.227:8090

187.162.248.237:80

172.104.169.32:8080

199.203.62.165:80

45.161.242.102:80

45.46.37.97:80

96.227.52.8:443

65.36.62.20:80

220.109.145.69:80

rsa_pubkey.plain

Targets

    • Target

      83d31e1afb0eed1dc3b834523c91cbf2_JaffaCakes118

    • Size

      172KB

    • MD5

      83d31e1afb0eed1dc3b834523c91cbf2

    • SHA1

      c687bb31b5ca5a01188b36ec26a9660256370229

    • SHA256

      8588b000cfc1b52115d3da02cf493abfeaa40ab908a4a4f17796a22bb8afcdc9

    • SHA512

      f1cb615a0b8232e821ee4c31a6d7e47bc99ab615b8bb7b468c598adc9f1106ecf48116fc492ff6661f669b67e8f2cd694d33f9912d088a5d0db48ae71b4808d9

    • SSDEEP

      1536:SvrrLwNwOTkX8CsVTC/8z/20X6AV8EiOpOACFsyfP292RiWV0IFT5mDzsoErpYj/:irLs2sL9C/sjzTT/shO9wT3F96OvOQ6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks