General

  • Target

    e19f33696f8ad990a3010f0444169af0_JaffaCakes118

  • Size

    848KB

  • Sample

    240915-d3ex1stdrb

  • MD5

    e19f33696f8ad990a3010f0444169af0

  • SHA1

    1c6289f457365e6dc85dca2ffe656ed1287f1574

  • SHA256

    40cd76b4e02a4aaf26bdca81ccda6ff1d10b77a44379b249bfad93e63f1579ad

  • SHA512

    2ede5c10a301675b761b04449e2da27f7ab59303499da6fc0c7d3d3b5ab0791e6748831d1da7ad609940f3d5340e4df9d591c296c1b4b592f2958adf24e45bf2

  • SSDEEP

    6144:cTaQZdJnaB1kNOnFSm9tc6c6c6c6c6c6c6c6c6csI+7L1NIDK:cGQfJYFrZL

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

45.16.226.117:443

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

45.161.242.102:80

37.52.87.0:80

137.74.106.111:7080

71.197.211.156:80

217.199.160.224:7080

186.70.127.199:8090

50.28.51.143:8080

190.115.18.139:8080

85.105.140.135:443

24.148.98.177:80

181.30.61.163:443

192.241.146.84:8080

185.94.252.27:443

77.238.212.227:80

185.94.252.12:80

190.147.137.153:443

rsa_pubkey.plain

Targets

    • Target

      e19f33696f8ad990a3010f0444169af0_JaffaCakes118

    • Size

      848KB

    • MD5

      e19f33696f8ad990a3010f0444169af0

    • SHA1

      1c6289f457365e6dc85dca2ffe656ed1287f1574

    • SHA256

      40cd76b4e02a4aaf26bdca81ccda6ff1d10b77a44379b249bfad93e63f1579ad

    • SHA512

      2ede5c10a301675b761b04449e2da27f7ab59303499da6fc0c7d3d3b5ab0791e6748831d1da7ad609940f3d5340e4df9d591c296c1b4b592f2958adf24e45bf2

    • SSDEEP

      6144:cTaQZdJnaB1kNOnFSm9tc6c6c6c6c6c6c6c6c6csI+7L1NIDK:cGQfJYFrZL

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks