General

  • Target

    eb5094c9b19a94c9169175f7f12ce661_JaffaCakes118

  • Size

    272KB

  • Sample

    240919-pft9zaxfpe

  • MD5

    eb5094c9b19a94c9169175f7f12ce661

  • SHA1

    7628389c38a3fedc3385ac7c23597cc5e0ad58f5

  • SHA256

    66ebf3a6ad05e989a0c1a461811be71ec4e46dd99d9aa950329c5a3a7475338a

  • SHA512

    625c63dbcccf4cc2bc71af012a887b24cef249adddb796535f051621e037a67b88a608a5675fa0ce11377099d588b56e6a23fad668a78568b2c0cf51da341165

  • SSDEEP

    6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgmJWIafGX40T:oCBfvLoaPDHi2JgfOn

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.110.236.121:8080

149.202.5.139:443

153.92.4.96:8080

51.75.163.68:7080

143.95.101.72:8080

190.225.150.234:80

186.227.146.102:80

181.137.229.1:80

175.29.183.2:80

77.74.78.80:443

175.139.144.229:8080

222.159.240.58:80

190.55.186.229:80

190.190.15.20:80

157.245.138.101:7080

46.32.229.152:8080

195.201.56.70:8080

198.57.203.63:8080

157.7.164.178:8081

189.39.32.161:80

rsa_pubkey.plain

Targets

    • Target

      eb5094c9b19a94c9169175f7f12ce661_JaffaCakes118

    • Size

      272KB

    • MD5

      eb5094c9b19a94c9169175f7f12ce661

    • SHA1

      7628389c38a3fedc3385ac7c23597cc5e0ad58f5

    • SHA256

      66ebf3a6ad05e989a0c1a461811be71ec4e46dd99d9aa950329c5a3a7475338a

    • SHA512

      625c63dbcccf4cc2bc71af012a887b24cef249adddb796535f051621e037a67b88a608a5675fa0ce11377099d588b56e6a23fad668a78568b2c0cf51da341165

    • SSDEEP

      6144:ADC5yQfvp9e4YbTaPnEu/+6i5j0RgmJWIafGX40T:oCBfvLoaPDHi2JgfOn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks