General

  • Target

    cad42e39410e140807324206c93672cd_JaffaCakes118

  • Size

    344KB

  • Sample

    240830-pkd4jstejd

  • MD5

    cad42e39410e140807324206c93672cd

  • SHA1

    dee61d5a7bee97f2db340b2485ebd5f64822a368

  • SHA256

    88f999e7ea2cf3d13500488a966b97ffdae6ca97a02fc84bcd810b8c629a6911

  • SHA512

    252913ae2333180761a599bff1d3963c1fcec5385dfa0936bff96f64f75a07226785ff699b1bb4bf510bce4356a61427e511fad5548593693fa8313bae45fd45

  • SSDEEP

    6144:eigTTOKYyDCJPXskJ+EX+/lAAgVH4xckmh1Zf5MiSi8kv:eigTTOnyDQvp+U+/sFkmPZiGv

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

185.234.72.64:443

51.68.220.244:8080

206.81.10.215:8080

206.189.112.148:8080

200.71.148.138:8080

192.81.213.192:8080

189.209.217.49:80

190.53.135.159:21

115.78.95.230:443

94.192.228.255:80

190.147.215.53:22

31.12.67.62:7080

31.31.77.83:443

50.116.86.205:8080

80.11.163.139:21

211.63.71.72:8080

104.131.11.150:8080

103.39.131.88:80

90.77.228.193:8090

46.105.131.87:80

rsa_pubkey.plain

Targets

    • Target

      cad42e39410e140807324206c93672cd_JaffaCakes118

    • Size

      344KB

    • MD5

      cad42e39410e140807324206c93672cd

    • SHA1

      dee61d5a7bee97f2db340b2485ebd5f64822a368

    • SHA256

      88f999e7ea2cf3d13500488a966b97ffdae6ca97a02fc84bcd810b8c629a6911

    • SHA512

      252913ae2333180761a599bff1d3963c1fcec5385dfa0936bff96f64f75a07226785ff699b1bb4bf510bce4356a61427e511fad5548593693fa8313bae45fd45

    • SSDEEP

      6144:eigTTOKYyDCJPXskJ+EX+/lAAgVH4xckmh1Zf5MiSi8kv:eigTTOnyDQvp+U+/sFkmPZiGv

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks