General

  • Target

    9d4a3dd3056767eec928d962fcebdfcc_JaffaCakes118

  • Size

    238KB

  • Sample

    240816-hadlpsvamn

  • MD5

    9d4a3dd3056767eec928d962fcebdfcc

  • SHA1

    ee2f6f4ffaeb4dcc1dbbae46736be5b7284de0fc

  • SHA256

    fd90111ae0cbd782c9220c3f48d75ee31c0f5c9646d9d3bdd26b4ba99811ef48

  • SHA512

    0b77230cb97496949cc66ee6c030ec2092ea20ff50f09d839cce19e5032142193757135fcd022d0869151a1d1dc2432ade75b77a3fca52dd48c26be4736960de

  • SSDEEP

    3072:q5ZJ0spZady+KI+DLd7wNJfgnzNgy8MRNFKTOfQu0TQ1R:q5ZJ08AdAISL6/Y9RDKGQNQ1R

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.43.32.186:80

38.111.46.46:8080

134.209.36.254:8080

162.241.242.173:8080

74.120.55.163:80

61.92.17.12:80

219.74.18.66:443

156.155.166.221:80

104.131.44.150:8080

37.139.21.175:8080

94.1.108.190:443

169.239.182.217:8080

220.245.198.194:80

139.99.158.11:443

91.211.88.52:7080

62.75.141.82:80

174.45.13.118:80

137.119.36.33:80

188.219.31.12:80

103.86.49.11:8080

rsa_pubkey.plain

Targets

    • Target

      9d4a3dd3056767eec928d962fcebdfcc_JaffaCakes118

    • Size

      238KB

    • MD5

      9d4a3dd3056767eec928d962fcebdfcc

    • SHA1

      ee2f6f4ffaeb4dcc1dbbae46736be5b7284de0fc

    • SHA256

      fd90111ae0cbd782c9220c3f48d75ee31c0f5c9646d9d3bdd26b4ba99811ef48

    • SHA512

      0b77230cb97496949cc66ee6c030ec2092ea20ff50f09d839cce19e5032142193757135fcd022d0869151a1d1dc2432ade75b77a3fca52dd48c26be4736960de

    • SSDEEP

      3072:q5ZJ0spZady+KI+DLd7wNJfgnzNgy8MRNFKTOfQu0TQ1R:q5ZJ08AdAISL6/Y9RDKGQNQ1R

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks