General

  • Target

    b6e5c10c16b49c500212287d8420baad_JaffaCakes118

  • Size

    216KB

  • Sample

    240822-js1pmawcpb

  • MD5

    b6e5c10c16b49c500212287d8420baad

  • SHA1

    254d37e008082751ad31259fd033d030c26b516b

  • SHA256

    04d8dd3e9ed96a9a2ee0a878dd3c648f3607918877243c31a13c79bb1e26bb83

  • SHA512

    ec3c0a7c349a34a85dc903d05cf10f92c8db9d60b9d4ab9a62f681211fee9d56e0884a3d067b420e84715eef6df1c3ea58c7717eb8ddbb284ce3f1aa1ed0f7c9

  • SSDEEP

    3072:t0bbG3u+UULgpJrfp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrkrzxsW9ZKQhc

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

108.46.29.236:80

159.203.116.47:8080

173.249.6.108:443

94.124.59.22:8080

94.200.114.161:80

139.130.242.43:80

134.209.36.254:8080

74.208.45.104:8080

139.162.108.71:8080

47.144.21.12:443

95.213.236.64:8080

201.173.217.124:443

85.105.205.77:8080

85.152.162.105:80

153.137.36.142:80

87.106.136.232:8080

87.106.139.101:8080

213.196.135.145:80

67.10.155.92:80

168.235.67.138:7080

rsa_pubkey.plain

Targets

    • Target

      b6e5c10c16b49c500212287d8420baad_JaffaCakes118

    • Size

      216KB

    • MD5

      b6e5c10c16b49c500212287d8420baad

    • SHA1

      254d37e008082751ad31259fd033d030c26b516b

    • SHA256

      04d8dd3e9ed96a9a2ee0a878dd3c648f3607918877243c31a13c79bb1e26bb83

    • SHA512

      ec3c0a7c349a34a85dc903d05cf10f92c8db9d60b9d4ab9a62f681211fee9d56e0884a3d067b420e84715eef6df1c3ea58c7717eb8ddbb284ce3f1aa1ed0f7c9

    • SSDEEP

      3072:t0bbG3u+UULgpJrfp+tZrzxs51z63f0U9ZKQXU0c:6bcuOsrkrzxsW9ZKQhc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks