General

  • Target

    d61fcd7b338cc1777671264a47cbc1f4_JaffaCakes118

  • Size

    980KB

  • Sample

    240909-mgxqdawakf

  • MD5

    d61fcd7b338cc1777671264a47cbc1f4

  • SHA1

    2bddaeb1ad9f290bcb2005436a6b3879ccabfa32

  • SHA256

    d82f6074ebd70020045bd80b4124c404a3f0619f10be937fb1235c067e5203d4

  • SHA512

    b50a97a650e6d1be3446b4471f56d1410b38c411c15147891b8cc3d1c8465dfd88c50a3c1a17520d6fc56587f019a9d758e85baf65a39cef53f571fc96f9f515

  • SSDEEP

    12288:r2vTqjC1nHI7KfQMTB+wypSlbDoccv4QkNmS:r2GO1nHJQMVDysbEYQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

192.158.216.73:80

85.214.28.226:8080

142.44.137.67:443

162.241.242.173:8080

85.152.162.105:80

62.30.7.67:443

78.24.219.147:8080

74.120.55.163:80

169.239.182.217:8080

216.208.76.186:80

95.213.236.64:8080

200.114.213.233:8080

104.131.44.150:8080

70.121.172.89:80

75.139.38.211:80

185.94.252.104:443

97.82.79.83:80

103.86.49.11:8080

79.98.24.39:8080

83.169.36.251:8080

rsa_pubkey.plain

Targets

    • Target

      d61fcd7b338cc1777671264a47cbc1f4_JaffaCakes118

    • Size

      980KB

    • MD5

      d61fcd7b338cc1777671264a47cbc1f4

    • SHA1

      2bddaeb1ad9f290bcb2005436a6b3879ccabfa32

    • SHA256

      d82f6074ebd70020045bd80b4124c404a3f0619f10be937fb1235c067e5203d4

    • SHA512

      b50a97a650e6d1be3446b4471f56d1410b38c411c15147891b8cc3d1c8465dfd88c50a3c1a17520d6fc56587f019a9d758e85baf65a39cef53f571fc96f9f515

    • SSDEEP

      12288:r2vTqjC1nHI7KfQMTB+wypSlbDoccv4QkNmS:r2GO1nHJQMVDysbEYQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks