General

  • Target

    99876ebd421b57bdeddd844885f2cbe8_JaffaCakes118

  • Size

    149KB

  • Sample

    240815-j8y6qsybmr

  • MD5

    99876ebd421b57bdeddd844885f2cbe8

  • SHA1

    499de7f8f8e638e5cc0f55a8381aa73e9722c20f

  • SHA256

    1515c008988836064ac8ea9a48c473470252e778941564d8e4782fea4923d5bc

  • SHA512

    4beacf0bf98052c82b3e6d3bf17d44d2051c8173337af1a4b972ae82ff8b8358bd7e7469e973af8e7e469edd78ae7c0e6bad242bd5ff6f20e67df47282b3454d

  • SSDEEP

    3072:WY4s5aoSrBTn/3s0Y6OtXjMAW1s7uA+ene1gef:WYNSp/tY6AjpL+enkgef

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080

rsa_pubkey.plain

Targets

    • Target

      99876ebd421b57bdeddd844885f2cbe8_JaffaCakes118

    • Size

      149KB

    • MD5

      99876ebd421b57bdeddd844885f2cbe8

    • SHA1

      499de7f8f8e638e5cc0f55a8381aa73e9722c20f

    • SHA256

      1515c008988836064ac8ea9a48c473470252e778941564d8e4782fea4923d5bc

    • SHA512

      4beacf0bf98052c82b3e6d3bf17d44d2051c8173337af1a4b972ae82ff8b8358bd7e7469e973af8e7e469edd78ae7c0e6bad242bd5ff6f20e67df47282b3454d

    • SSDEEP

      3072:WY4s5aoSrBTn/3s0Y6OtXjMAW1s7uA+ene1gef:WYNSp/tY6AjpL+enkgef

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks