General

  • Target

    b529a862ea0859b019ec59cb0c96e36c_JaffaCakes118

  • Size

    312KB

  • Sample

    240616-zqv95axepb

  • MD5

    b529a862ea0859b019ec59cb0c96e36c

  • SHA1

    a3997dec92f66702d0dff9490b91264309987c9c

  • SHA256

    d298e91476ca19786493e72aa0cd95984d0a22e69712db04d4bcfd9256aff9ec

  • SHA512

    129a7ea67e8f33da8128277aac936b3c9cc51d176c0418177ef0af351795fc7f29a362476a1a196fab1c55bec99cdadccf6e8acc30f59411a871f95091a6a5ce

  • SSDEEP

    6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTst:BViYC3aZU53QuIjLKdwGg

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

68.187.160.28:443

97.120.32.227:80

187.188.166.192:8080

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

68.174.15.223:80

63.246.252.234:80

93.148.252.90:80

74.59.187.94:80

185.160.212.3:80

46.28.111.142:7080

183.99.239.141:80

68.129.203.162:443

144.139.56.105:80

191.183.21.190:80

81.157.234.90:8080

138.68.106.4:7080

203.130.0.69:80

rsa_pubkey.plain

Targets

    • Target

      b529a862ea0859b019ec59cb0c96e36c_JaffaCakes118

    • Size

      312KB

    • MD5

      b529a862ea0859b019ec59cb0c96e36c

    • SHA1

      a3997dec92f66702d0dff9490b91264309987c9c

    • SHA256

      d298e91476ca19786493e72aa0cd95984d0a22e69712db04d4bcfd9256aff9ec

    • SHA512

      129a7ea67e8f33da8128277aac936b3c9cc51d176c0418177ef0af351795fc7f29a362476a1a196fab1c55bec99cdadccf6e8acc30f59411a871f95091a6a5ce

    • SSDEEP

      6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTst:BViYC3aZU53QuIjLKdwGg

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks