General

  • Target

    8a20282dacb49fdf51290b8a2197e50e_JaffaCakes118

  • Size

    244KB

  • Sample

    240601-l3ek9aac93

  • MD5

    8a20282dacb49fdf51290b8a2197e50e

  • SHA1

    f658551a7bb4795c4cba3b765e952a39acac7df1

  • SHA256

    d03c9f24e3a75b2648b11ecb8e87f3d44a0e78c63a1ba92d647940793d28f8ab

  • SHA512

    d4fd15838cf51fae1ba4216c18720d2acda144806731ac316b9b68abaa2d1bac866ee7ac0efa7e8cb7280f5b28ab0cd463a5bc38613607dac17300ce2c433c04

  • SSDEEP

    3072:yjQlpRi39Mm+sQ71Rd1auo1GUVPEIEqLtH:y0lpRaMdJ1v1iPEc5H

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080

rsa_pubkey.plain

Targets

    • Target

      8a20282dacb49fdf51290b8a2197e50e_JaffaCakes118

    • Size

      244KB

    • MD5

      8a20282dacb49fdf51290b8a2197e50e

    • SHA1

      f658551a7bb4795c4cba3b765e952a39acac7df1

    • SHA256

      d03c9f24e3a75b2648b11ecb8e87f3d44a0e78c63a1ba92d647940793d28f8ab

    • SHA512

      d4fd15838cf51fae1ba4216c18720d2acda144806731ac316b9b68abaa2d1bac866ee7ac0efa7e8cb7280f5b28ab0cd463a5bc38613607dac17300ce2c433c04

    • SSDEEP

      3072:yjQlpRi39Mm+sQ71Rd1auo1GUVPEIEqLtH:y0lpRaMdJ1v1iPEc5H

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks