General

  • Target

    428b446e13aa9161cba961f1fac46506_JaffaCakes118

  • Size

    216KB

  • Sample

    240729-m6s4gszdqa

  • MD5

    428b446e13aa9161cba961f1fac46506

  • SHA1

    809fe076eee2c3766e274a2f214f94314108729f

  • SHA256

    68ee5d1290f57d90a546813e859aee860e17c6ceea9957c2cd8e9a415ec3e1e8

  • SHA512

    02edc529d38ed4147eb0f1adb1e7f0b3cac2c6a8dbba21471cc806f97c43545be5c52296e742fdc0880d93f8df9c4b842a61b8002e02b237c12fceb273a631aa

  • SSDEEP

    3072:t0bbG3u+UULgpJrjp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrQrzxsW9ZKQhc

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

108.46.29.236:80

159.203.116.47:8080

173.249.6.108:443

94.124.59.22:8080

94.200.114.161:80

139.130.242.43:80

134.209.36.254:8080

74.208.45.104:8080

139.162.108.71:8080

47.144.21.12:443

95.213.236.64:8080

201.173.217.124:443

85.105.205.77:8080

85.152.162.105:80

153.137.36.142:80

87.106.136.232:8080

87.106.139.101:8080

213.196.135.145:80

67.10.155.92:80

168.235.67.138:7080

rsa_pubkey.plain

Targets

    • Target

      428b446e13aa9161cba961f1fac46506_JaffaCakes118

    • Size

      216KB

    • MD5

      428b446e13aa9161cba961f1fac46506

    • SHA1

      809fe076eee2c3766e274a2f214f94314108729f

    • SHA256

      68ee5d1290f57d90a546813e859aee860e17c6ceea9957c2cd8e9a415ec3e1e8

    • SHA512

      02edc529d38ed4147eb0f1adb1e7f0b3cac2c6a8dbba21471cc806f97c43545be5c52296e742fdc0880d93f8df9c4b842a61b8002e02b237c12fceb273a631aa

    • SSDEEP

      3072:t0bbG3u+UULgpJrjp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrQrzxsW9ZKQhc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks