General

  • Target

    c58e362e536f0d006a1eda9372221a7e_JaffaCakes118

  • Size

    446KB

  • Sample

    240827-xs95ysycpp

  • MD5

    c58e362e536f0d006a1eda9372221a7e

  • SHA1

    9cf54fef792dd214fa645f02ae8279ff71c8d0c0

  • SHA256

    c33ce2407f8011e2801eedd19a15e0f84a5626b7c030422801b851a8b3ad0f6d

  • SHA512

    0ca51752368b2661d9cf3f7f9ae54dfa7d08435d75e652538e57b345e581e1c1d4568a676b6d5b20ea8c2cee8db16c8e4f5c4dbf1cba9055e3878cdec1b9f7ed

  • SSDEEP

    6144:NwekW4xuXsbOrpV6tQvq6H/iawC7MLSnyZtC:NwvuXkOrpV7v7HaafM2nyZ

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

71.72.196.159:80

134.209.36.254:8080

120.138.30.150:8080

94.23.216.33:80

157.245.99.39:8080

137.59.187.107:8080

94.23.237.171:443

61.19.246.238:443

156.155.166.221:80

50.35.17.13:80

153.137.36.142:80

91.211.88.52:7080

209.141.54.221:8080

185.94.252.104:443

174.45.13.118:80

87.106.136.232:8080

62.75.141.82:80

213.196.135.145:80

188.219.31.12:80

82.80.155.43:80

rsa_pubkey.plain

Targets

    • Target

      c58e362e536f0d006a1eda9372221a7e_JaffaCakes118

    • Size

      446KB

    • MD5

      c58e362e536f0d006a1eda9372221a7e

    • SHA1

      9cf54fef792dd214fa645f02ae8279ff71c8d0c0

    • SHA256

      c33ce2407f8011e2801eedd19a15e0f84a5626b7c030422801b851a8b3ad0f6d

    • SHA512

      0ca51752368b2661d9cf3f7f9ae54dfa7d08435d75e652538e57b345e581e1c1d4568a676b6d5b20ea8c2cee8db16c8e4f5c4dbf1cba9055e3878cdec1b9f7ed

    • SSDEEP

      6144:NwekW4xuXsbOrpV6tQvq6H/iawC7MLSnyZtC:NwvuXkOrpV7v7HaafM2nyZ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks