General

  • Target

    84aba2727476cb2db30a44e7cc6ecc76_JaffaCakes118

  • Size

    287KB

  • Sample

    240530-s3flwaed79

  • MD5

    84aba2727476cb2db30a44e7cc6ecc76

  • SHA1

    c29fdbe2d4911f1f6458b01f8f9ddf8e5199a50c

  • SHA256

    ce6e354ee95722848879accb6dd2e273bf3703498820852030ea2081263bf3ce

  • SHA512

    940f0fc7abda3c2261e75cc727f2e678d217429a5448664423ed8506dbdc877f983c9e7361f47a8d5143f8408130b319c8f95486bea36c3e06c1dcd63645c8ae

  • SSDEEP

    6144:n5NeJNQUnrdBFA7u3BncB0lpPW6I/Y9abCcpKAGJ6goqvUt4l5:2BcB0PPWl/Y9ab8AG5oqvl5

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

107.170.27.84:443

85.234.143.94:8080

204.225.249.100:8080

173.212.220.251:443

60.54.37.25:80

178.249.187.151:8080

91.83.93.124:7080

77.245.101.134:8080

68.183.190.199:8080

203.25.159.3:8080

41.75.135.93:7080

46.28.111.142:7080

163.172.40.218:7080

45.79.95.107:443

181.198.203.45:443

185.86.148.222:8080

181.231.62.54:80

186.23.132.93:990

46.29.183.211:8080

62.75.143.100:7080

rsa_pubkey.plain

Targets

    • Target

      84aba2727476cb2db30a44e7cc6ecc76_JaffaCakes118

    • Size

      287KB

    • MD5

      84aba2727476cb2db30a44e7cc6ecc76

    • SHA1

      c29fdbe2d4911f1f6458b01f8f9ddf8e5199a50c

    • SHA256

      ce6e354ee95722848879accb6dd2e273bf3703498820852030ea2081263bf3ce

    • SHA512

      940f0fc7abda3c2261e75cc727f2e678d217429a5448664423ed8506dbdc877f983c9e7361f47a8d5143f8408130b319c8f95486bea36c3e06c1dcd63645c8ae

    • SSDEEP

      6144:n5NeJNQUnrdBFA7u3BncB0lpPW6I/Y9abCcpKAGJ6goqvUt4l5:2BcB0PPWl/Y9ab8AG5oqvl5

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks