General

  • Target

    b3efc6386a9cdeba0fd699e80eea838e_JaffaCakes118

  • Size

    456KB

  • Sample

    240616-rkw1gawema

  • MD5

    b3efc6386a9cdeba0fd699e80eea838e

  • SHA1

    8760b94f9309dfc9957a871f51cee770e0f57ae2

  • SHA256

    21712bed013d1437631a7766bc34bf0e5dba14ca96b6647e3f71c9a64eb73e21

  • SHA512

    4ba9a8a8afc8ed13b43b87a744d8e12ce2585f527629e5975a12f9314c0448db4c0a8db434bee92c342ab564e55138a62bffdd6dd6750576ff331d13bfb88650

  • SSDEEP

    12288:J4W1tA2ggxOY0IC8qrA6VZmfL2ygDLgeFF:JqgOY02qrA6V5FF

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

155.186.0.121:80

51.38.124.206:80

82.196.15.205:8080

38.88.126.202:8080

219.92.13.25:80

111.67.77.202:8080

95.9.180.128:80

77.90.136.129:8080

190.163.31.26:80

74.136.144.133:80

104.131.103.37:8080

45.33.77.42:8080

192.241.143.52:8080

78.249.119.122:80

177.74.228.34:80

152.169.22.67:80

92.24.50.153:80

5.189.178.202:8080

104.131.41.185:8080

82.230.1.24:80

rsa_pubkey.plain

Targets

    • Target

      b3efc6386a9cdeba0fd699e80eea838e_JaffaCakes118

    • Size

      456KB

    • MD5

      b3efc6386a9cdeba0fd699e80eea838e

    • SHA1

      8760b94f9309dfc9957a871f51cee770e0f57ae2

    • SHA256

      21712bed013d1437631a7766bc34bf0e5dba14ca96b6647e3f71c9a64eb73e21

    • SHA512

      4ba9a8a8afc8ed13b43b87a744d8e12ce2585f527629e5975a12f9314c0448db4c0a8db434bee92c342ab564e55138a62bffdd6dd6750576ff331d13bfb88650

    • SSDEEP

      12288:J4W1tA2ggxOY0IC8qrA6VZmfL2ygDLgeFF:JqgOY02qrA6V5FF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks