General

  • Target

    e6144c8d64801bd527fa8d1d6a768a75_JaffaCakes118

  • Size

    112KB

  • Sample

    240917-fgxl2svgnh

  • MD5

    e6144c8d64801bd527fa8d1d6a768a75

  • SHA1

    0009a6010f10b85b5fd6097148406febd4ad4bad

  • SHA256

    9427d221bb73b8870ca340dfcac82fd871ddde38a52691932686749200d2f757

  • SHA512

    959775a8775c570f4e53b484879b7a1af1fdc32274a48ca664d2f60240e4f88eeef791fc80111d53448f6d470ef8fbcca73f71fe3c0e93448fe82c8d352f3cc6

  • SSDEEP

    1536:zIyJFo4OTP8+QUtGvH7G5TJIyeyz29rc+ZqRNqiwm7EZ:5J24t+QUtG/S5narc+ZaqiDS

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

71.72.196.159:80

134.209.36.254:8080

120.138.30.150:8080

94.23.216.33:80

157.245.99.39:8080

137.59.187.107:8080

94.23.237.171:443

61.19.246.238:443

156.155.166.221:80

50.35.17.13:80

153.137.36.142:80

91.211.88.52:7080

209.141.54.221:8080

185.94.252.104:443

174.45.13.118:80

87.106.136.232:8080

62.75.141.82:80

213.196.135.145:80

188.219.31.12:80

82.80.155.43:80

rsa_pubkey.plain

Targets

    • Target

      e6144c8d64801bd527fa8d1d6a768a75_JaffaCakes118

    • Size

      112KB

    • MD5

      e6144c8d64801bd527fa8d1d6a768a75

    • SHA1

      0009a6010f10b85b5fd6097148406febd4ad4bad

    • SHA256

      9427d221bb73b8870ca340dfcac82fd871ddde38a52691932686749200d2f757

    • SHA512

      959775a8775c570f4e53b484879b7a1af1fdc32274a48ca664d2f60240e4f88eeef791fc80111d53448f6d470ef8fbcca73f71fe3c0e93448fe82c8d352f3cc6

    • SSDEEP

      1536:zIyJFo4OTP8+QUtGvH7G5TJIyeyz29rc+ZqRNqiwm7EZ:5J24t+QUtG/S5narc+ZaqiDS

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks