General

  • Target

    968cd3d5e15b8a604b6b8aaceafbbdb6_JaffaCakes118

  • Size

    272KB

  • Sample

    240814-r9ht5syarc

  • MD5

    968cd3d5e15b8a604b6b8aaceafbbdb6

  • SHA1

    c8d6d197d88343290ef3609ecf832a1839726427

  • SHA256

    6072faf8c533b5687c7b0fbdf500535c4bca21a8d1ae2144a55c3c4e15225463

  • SHA512

    85197c7380c49bdeb7c55c63ee0062c0dc5e24a4e2f6169804fa72a111a9058f99f855db3061abe3ee66cf2448925c1765664a21e1367b5e413aaf415d318f43

  • SSDEEP

    6144:aiV5YLPsjOe5JK27Ie4on6IfK2z3NQoTmq+7AJRzQ:xOe5o2+I3SqqolQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Targets

    • Target

      968cd3d5e15b8a604b6b8aaceafbbdb6_JaffaCakes118

    • Size

      272KB

    • MD5

      968cd3d5e15b8a604b6b8aaceafbbdb6

    • SHA1

      c8d6d197d88343290ef3609ecf832a1839726427

    • SHA256

      6072faf8c533b5687c7b0fbdf500535c4bca21a8d1ae2144a55c3c4e15225463

    • SHA512

      85197c7380c49bdeb7c55c63ee0062c0dc5e24a4e2f6169804fa72a111a9058f99f855db3061abe3ee66cf2448925c1765664a21e1367b5e413aaf415d318f43

    • SSDEEP

      6144:aiV5YLPsjOe5JK27Ie4on6IfK2z3NQoTmq+7AJRzQ:xOe5o2+I3SqqolQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks