General

  • Target

    db784415f8d061726f527b3dd82baa21_JaffaCakes118

  • Size

    272KB

  • Sample

    240912-age44s1cpf

  • MD5

    db784415f8d061726f527b3dd82baa21

  • SHA1

    66794bb335c5ed58d285a7645f5522939f97037a

  • SHA256

    d2f93447f9cca3815664c69495ade9494aeb15e417c82f404671ae81e4ddc05b

  • SHA512

    0879b656cb87823a115d82356fa41a23e2febbbc9b9129064a98b94d62a8f824ac5ac7ebba7f6961e5afac7462beedeebeac1e5dfcf35a694103141327cc7d20

  • SSDEEP

    6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgjJWIafGX40T:oCBfvLoaPDHiTJgfOn

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.110.236.121:8080

149.202.5.139:443

153.92.4.96:8080

51.75.163.68:7080

143.95.101.72:8080

190.225.150.234:80

186.227.146.102:80

181.137.229.1:80

175.29.183.2:80

77.74.78.80:443

175.139.144.229:8080

222.159.240.58:80

190.55.186.229:80

190.190.15.20:80

157.245.138.101:7080

46.32.229.152:8080

195.201.56.70:8080

198.57.203.63:8080

157.7.164.178:8081

189.39.32.161:80

rsa_pubkey.plain

Targets

    • Target

      db784415f8d061726f527b3dd82baa21_JaffaCakes118

    • Size

      272KB

    • MD5

      db784415f8d061726f527b3dd82baa21

    • SHA1

      66794bb335c5ed58d285a7645f5522939f97037a

    • SHA256

      d2f93447f9cca3815664c69495ade9494aeb15e417c82f404671ae81e4ddc05b

    • SHA512

      0879b656cb87823a115d82356fa41a23e2febbbc9b9129064a98b94d62a8f824ac5ac7ebba7f6961e5afac7462beedeebeac1e5dfcf35a694103141327cc7d20

    • SSDEEP

      6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgjJWIafGX40T:oCBfvLoaPDHiTJgfOn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks