General

  • Target

    52b268d17882f79e1d8bbb5f3cd78c36_JaffaCakes118

  • Size

    634KB

  • Sample

    240729-t2l8pssbmc

  • MD5

    52b268d17882f79e1d8bbb5f3cd78c36

  • SHA1

    44faeb85f85befd85e7ba477de6db6f547517a80

  • SHA256

    a75af2c6fc857f39407da841b4b78eb8af7ecf59d881cac38ed479e7b4c0c44d

  • SHA512

    058cc89c95b956fc9867c9d975b90dea15a6a2722ffd19f3ce6b0716075b3de12d90cd6e51d1c63a5128b34f62eb8f6af9f705bdc2e92c7575f9139e2b57a4e0

  • SSDEEP

    6144:K9H+NDxL6GMGj8kl7muvrxwpntVsOGx4QKZXPk1jXPUVvfY0MA51by718jRJGu:KJ+Nd6Gmujx3uXPk1Dsm0bX6WjRJG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

45.16.226.117:443

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

45.161.242.102:80

37.52.87.0:80

137.74.106.111:7080

71.197.211.156:80

217.199.160.224:7080

186.70.127.199:8090

50.28.51.143:8080

190.115.18.139:8080

85.105.140.135:443

24.148.98.177:80

181.30.61.163:443

192.241.146.84:8080

185.94.252.27:443

77.238.212.227:80

185.94.252.12:80

190.147.137.153:443

rsa_pubkey.plain

Targets

    • Target

      52b268d17882f79e1d8bbb5f3cd78c36_JaffaCakes118

    • Size

      634KB

    • MD5

      52b268d17882f79e1d8bbb5f3cd78c36

    • SHA1

      44faeb85f85befd85e7ba477de6db6f547517a80

    • SHA256

      a75af2c6fc857f39407da841b4b78eb8af7ecf59d881cac38ed479e7b4c0c44d

    • SHA512

      058cc89c95b956fc9867c9d975b90dea15a6a2722ffd19f3ce6b0716075b3de12d90cd6e51d1c63a5128b34f62eb8f6af9f705bdc2e92c7575f9139e2b57a4e0

    • SSDEEP

      6144:K9H+NDxL6GMGj8kl7muvrxwpntVsOGx4QKZXPk1jXPUVvfY0MA51by718jRJGu:KJ+Nd6Gmujx3uXPk1Dsm0bX6WjRJG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks