General

  • Target

    d788f524cac169600711cf4427fc8f6b_JaffaCakes118

  • Size

    667KB

  • Sample

    240910-d9fg5avfmj

  • MD5

    d788f524cac169600711cf4427fc8f6b

  • SHA1

    6d1a00e4c788a4bfcba6af0c48cb5f1889e346fc

  • SHA256

    7337063c27f8b08ab73d8642f53d4dd52bd635aaea3178422b62664c9ec91307

  • SHA512

    7521d30dcf9bf863a36f67311eba7d13189176c3cf4082d75af81964bfcb6c8457ade1fbf97567dd868e34ac924576621269ec99f89841d3880dec21620bbbde

  • SSDEEP

    12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCfbnG:76J6/tniVNoDgQVN6mCip9fbG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Targets

    • Target

      d788f524cac169600711cf4427fc8f6b_JaffaCakes118

    • Size

      667KB

    • MD5

      d788f524cac169600711cf4427fc8f6b

    • SHA1

      6d1a00e4c788a4bfcba6af0c48cb5f1889e346fc

    • SHA256

      7337063c27f8b08ab73d8642f53d4dd52bd635aaea3178422b62664c9ec91307

    • SHA512

      7521d30dcf9bf863a36f67311eba7d13189176c3cf4082d75af81964bfcb6c8457ade1fbf97567dd868e34ac924576621269ec99f89841d3880dec21620bbbde

    • SSDEEP

      12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCfbnG:76J6/tniVNoDgQVN6mCip9fbG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.