General

  • Target

    b5e0d906dd350115f896fbe160573644_JaffaCakes118

  • Size

    72KB

  • Sample

    240617-ab15dsyfmj

  • MD5

    b5e0d906dd350115f896fbe160573644

  • SHA1

    ec8d9efc505104fb6228b3a552b4958b2940414c

  • SHA256

    8729e52104ec08ca7002b217c42c3ec12262badbb3f11faaab1829eba505c3cb

  • SHA512

    dc21857de4993e1da086fc0006f790b8b02997d0b5d6a87096f03caf0fbfe6e6e3332ead85ec22e909295732a7e3bfc63efdb962fb730f81a1bce73d8c5539e3

  • SSDEEP

    1536:LuBM4SllAj49aJ2oIwNI/Bo6R5TMbyfKZgQNtm:6BMXlW4YJhIJoi5DiZg20

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.63.7.166:8080

124.150.175.133:8080

51.38.134.203:8080

186.80.169.128:80

139.59.12.63:8080

72.10.33.195:8080

190.251.235.239:80

113.161.148.81:80

37.70.131.107:80

192.241.220.183:8080

14.161.6.60:80

77.74.78.80:443

115.79.195.246:80

190.171.153.139:80

50.63.13.135:8080

37.46.129.215:8080

163.172.107.70:8080

186.10.92.114:80

122.116.104.238:8080

113.160.180.109:80

rsa_pubkey.plain

Targets

    • Target

      b5e0d906dd350115f896fbe160573644_JaffaCakes118

    • Size

      72KB

    • MD5

      b5e0d906dd350115f896fbe160573644

    • SHA1

      ec8d9efc505104fb6228b3a552b4958b2940414c

    • SHA256

      8729e52104ec08ca7002b217c42c3ec12262badbb3f11faaab1829eba505c3cb

    • SHA512

      dc21857de4993e1da086fc0006f790b8b02997d0b5d6a87096f03caf0fbfe6e6e3332ead85ec22e909295732a7e3bfc63efdb962fb730f81a1bce73d8c5539e3

    • SSDEEP

      1536:LuBM4SllAj49aJ2oIwNI/Bo6R5TMbyfKZgQNtm:6BMXlW4YJhIJoi5DiZg20

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix ATT&CK v13

Tasks