General

  • Target

    e3c47026a1cefd5e8e24150c74aa756a_JaffaCakes118

  • Size

    272KB

  • Sample

    240916-bzm34sseqf

  • MD5

    e3c47026a1cefd5e8e24150c74aa756a

  • SHA1

    8d1a4f03d8b47f52c69f8a26f2adf9c4e787e6eb

  • SHA256

    0cd4d7bf2266b93a5aa2e1fecc9fecf6bc99d1d73dec2595aca0abc1c7b9cfff

  • SHA512

    f6af855dc5b62ef843d2bff0c82b52c3fe336922bd50b0e85c6d5b9786b1827ce0f7fea298ce532997e37a33734fe682839364fab0f2b33259a37cc3f8dd9196

  • SSDEEP

    6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgTJWIafGX40T:oCBfvLoaPDHiDJgfOn

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.110.236.121:8080

149.202.5.139:443

153.92.4.96:8080

51.75.163.68:7080

143.95.101.72:8080

190.225.150.234:80

186.227.146.102:80

181.137.229.1:80

175.29.183.2:80

77.74.78.80:443

175.139.144.229:8080

222.159.240.58:80

190.55.186.229:80

190.190.15.20:80

157.245.138.101:7080

46.32.229.152:8080

195.201.56.70:8080

198.57.203.63:8080

157.7.164.178:8081

189.39.32.161:80

rsa_pubkey.plain

Targets

    • Target

      e3c47026a1cefd5e8e24150c74aa756a_JaffaCakes118

    • Size

      272KB

    • MD5

      e3c47026a1cefd5e8e24150c74aa756a

    • SHA1

      8d1a4f03d8b47f52c69f8a26f2adf9c4e787e6eb

    • SHA256

      0cd4d7bf2266b93a5aa2e1fecc9fecf6bc99d1d73dec2595aca0abc1c7b9cfff

    • SHA512

      f6af855dc5b62ef843d2bff0c82b52c3fe336922bd50b0e85c6d5b9786b1827ce0f7fea298ce532997e37a33734fe682839364fab0f2b33259a37cc3f8dd9196

    • SSDEEP

      6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgTJWIafGX40T:oCBfvLoaPDHiDJgfOn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks