General

  • Target

    dec17d7825850152608322f220d8c810_JaffaCakes118

  • Size

    272KB

  • Sample

    240913-x59pysvdld

  • MD5

    dec17d7825850152608322f220d8c810

  • SHA1

    336838df13107a25976e192dfa224ae73bc61188

  • SHA256

    389edbbc5f33d36e9d388af335f2af5c1dd76269dacb7c775b364c281599690e

  • SHA512

    83c3785326531536b27aa25d45c21599e4a6307aac17f147ea427202f7054fef56bd1eb8a9e246e47fb444bddcb0661ae73acaf2aa327813c3af0021be1c26de

  • SSDEEP

    6144:aiV5YLPsjOe5JK27Ie4on6I5K2z3NQoTmq+7AJRzQ:xOe5o2+IpSqqolQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Targets

    • Target

      dec17d7825850152608322f220d8c810_JaffaCakes118

    • Size

      272KB

    • MD5

      dec17d7825850152608322f220d8c810

    • SHA1

      336838df13107a25976e192dfa224ae73bc61188

    • SHA256

      389edbbc5f33d36e9d388af335f2af5c1dd76269dacb7c775b364c281599690e

    • SHA512

      83c3785326531536b27aa25d45c21599e4a6307aac17f147ea427202f7054fef56bd1eb8a9e246e47fb444bddcb0661ae73acaf2aa327813c3af0021be1c26de

    • SSDEEP

      6144:aiV5YLPsjOe5JK27Ie4on6I5K2z3NQoTmq+7AJRzQ:xOe5o2+IpSqqolQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks