General

  • Target

    d54c4d834c0772f3fa87791b10a30b57_JaffaCakes118

  • Size

    344KB

  • Sample

    240908-3mls3atdle

  • MD5

    d54c4d834c0772f3fa87791b10a30b57

  • SHA1

    98552439700dc18af30ba297855b2705c31efc0b

  • SHA256

    c38cf717c93028bd94a946f0530132d11d89e1a42380d7982e131e4d34b639ab

  • SHA512

    d0bb96704c9f20c7c8f955c970e82811864b35b2ec2d2128d16f3427bac2f3f79a9f71bf8937b60a61e1c68412b1c791aa476d91f4231a7dd565f9a5e734ec48

  • SSDEEP

    6144:eigTTOKYyDCJPXskJ+EX+/lAAgVH4xckmh1Zf5MiSi8ke:eigTTOnyDQvp+U+/sFkmPZiGe

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

185.234.72.64:443

51.68.220.244:8080

206.81.10.215:8080

206.189.112.148:8080

200.71.148.138:8080

192.81.213.192:8080

189.209.217.49:80

190.53.135.159:21

115.78.95.230:443

94.192.228.255:80

190.147.215.53:22

31.12.67.62:7080

31.31.77.83:443

50.116.86.205:8080

80.11.163.139:21

211.63.71.72:8080

104.131.11.150:8080

103.39.131.88:80

90.77.228.193:8090

46.105.131.87:80

rsa_pubkey.plain

Targets

    • Target

      d54c4d834c0772f3fa87791b10a30b57_JaffaCakes118

    • Size

      344KB

    • MD5

      d54c4d834c0772f3fa87791b10a30b57

    • SHA1

      98552439700dc18af30ba297855b2705c31efc0b

    • SHA256

      c38cf717c93028bd94a946f0530132d11d89e1a42380d7982e131e4d34b639ab

    • SHA512

      d0bb96704c9f20c7c8f955c970e82811864b35b2ec2d2128d16f3427bac2f3f79a9f71bf8937b60a61e1c68412b1c791aa476d91f4231a7dd565f9a5e734ec48

    • SSDEEP

      6144:eigTTOKYyDCJPXskJ+EX+/lAAgVH4xckmh1Zf5MiSi8ke:eigTTOnyDQvp+U+/sFkmPZiGe

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks