General

  • Target

    d2e52da1aa01d1aa660b2552673e1639_JaffaCakes118

  • Size

    220KB

  • Sample

    240907-1kd94ayhra

  • MD5

    d2e52da1aa01d1aa660b2552673e1639

  • SHA1

    26306c04669591356820496e156d9e054ed3ab1f

  • SHA256

    d520919220401710fcd7778355130b59da2955cb0a6cae7fb3c0a5215c439b05

  • SHA512

    94e1283af26e5ce70f4dbdfb2e5f266016fa897df1d4aad6dfd89f7255ba95351700fd316d792706d11b60164bee8e7145c1aad267f440b580131bc260194b1f

  • SSDEEP

    3072:1mNXdDFrtXx7bZKxehc4bjLwEe/IN0r65lblNvakKHMxpNqWQ+xIYXD:mNxrtXRbQqvLXegc6HPa7

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Targets

    • Target

      d2e52da1aa01d1aa660b2552673e1639_JaffaCakes118

    • Size

      220KB

    • MD5

      d2e52da1aa01d1aa660b2552673e1639

    • SHA1

      26306c04669591356820496e156d9e054ed3ab1f

    • SHA256

      d520919220401710fcd7778355130b59da2955cb0a6cae7fb3c0a5215c439b05

    • SHA512

      94e1283af26e5ce70f4dbdfb2e5f266016fa897df1d4aad6dfd89f7255ba95351700fd316d792706d11b60164bee8e7145c1aad267f440b580131bc260194b1f

    • SSDEEP

      3072:1mNXdDFrtXx7bZKxehc4bjLwEe/IN0r65lblNvakKHMxpNqWQ+xIYXD:mNxrtXRbQqvLXegc6HPa7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks