General

  • Target

    bc7a52c72e29b2e5542aa820137e27d7_JaffaCakes118

  • Size

    72KB

  • Sample

    240618-r2cm6axhne

  • MD5

    bc7a52c72e29b2e5542aa820137e27d7

  • SHA1

    060c85f5233115d0bcd1012be3a5fe2ed2a9c37f

  • SHA256

    177f49a703ebd6945e2b0743138a4438d468eafbd07f6b5f2f0a27d9d00ea744

  • SHA512

    cbf695d5303dbe017562cde90ab8ade08931a66078058f2107cf43e0f27a857307332d1e11081db12cde10aed0db3346de7fbf3fb7f5536cc37132d3918f1c46

  • SSDEEP

    1536:UAvQywBuTeV59xDY6HwMJq2hhvwsIvEecwy/mwxiO:UGyBuwxDjLqajIvEgg3

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

185.215.227.107:443

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

172.104.169.32:8080

68.183.190.199:8080

187.162.248.237:80

82.76.111.249:443

184.66.18.83:80

190.6.193.152:8080

77.238.212.227:80

199.203.62.165:80

188.2.217.94:80

185.94.252.12:80

178.250.54.208:8080

206.15.68.237:443

65.36.62.20:80

216.47.196.104:80

219.92.8.17:8080

213.60.96.117:80

rsa_pubkey.plain

Targets

    • Target

      bc7a52c72e29b2e5542aa820137e27d7_JaffaCakes118

    • Size

      72KB

    • MD5

      bc7a52c72e29b2e5542aa820137e27d7

    • SHA1

      060c85f5233115d0bcd1012be3a5fe2ed2a9c37f

    • SHA256

      177f49a703ebd6945e2b0743138a4438d468eafbd07f6b5f2f0a27d9d00ea744

    • SHA512

      cbf695d5303dbe017562cde90ab8ade08931a66078058f2107cf43e0f27a857307332d1e11081db12cde10aed0db3346de7fbf3fb7f5536cc37132d3918f1c46

    • SSDEEP

      1536:UAvQywBuTeV59xDY6HwMJq2hhvwsIvEecwy/mwxiO:UGyBuwxDjLqajIvEgg3

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks