General

  • Target

    e7aebd6e292a3b3c3844a7600decb78c_JaffaCakes118

  • Size

    667KB

  • Sample

    240917-zpa8kathkg

  • MD5

    e7aebd6e292a3b3c3844a7600decb78c

  • SHA1

    0743d7ba4bca20772a6b2b34447490fceeb49064

  • SHA256

    8ac3e1bbfa00ba7ee69f4ea111228a08909641b481947bc4362b97c6bac533e8

  • SHA512

    b1d576d41bda4bdc7be36ddb4bdebbb157103ef2c18060d663acaa58f97f1a4ee392d89b6d4bcba86075648c45a2c4b4faaf3a06273d8c951ba5a92f6aa2c30c

  • SSDEEP

    12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCwbnG:76J6/tniVNoDgQVN6mCip9wbG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Targets

    • Target

      e7aebd6e292a3b3c3844a7600decb78c_JaffaCakes118

    • Size

      667KB

    • MD5

      e7aebd6e292a3b3c3844a7600decb78c

    • SHA1

      0743d7ba4bca20772a6b2b34447490fceeb49064

    • SHA256

      8ac3e1bbfa00ba7ee69f4ea111228a08909641b481947bc4362b97c6bac533e8

    • SHA512

      b1d576d41bda4bdc7be36ddb4bdebbb157103ef2c18060d663acaa58f97f1a4ee392d89b6d4bcba86075648c45a2c4b4faaf3a06273d8c951ba5a92f6aa2c30c

    • SSDEEP

      12288:76JJG//tnC5VCFSoDpaQlHfl6mCiWDaBMNCwbnG:76J6/tniVNoDgQVN6mCip9wbG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.