General

  • Target

    ef00cd9b844f389d9f231018d86e9c32_JaffaCakes118

  • Size

    198KB

  • Sample

    240921-d9alwatbra

  • MD5

    ef00cd9b844f389d9f231018d86e9c32

  • SHA1

    0d3a7cc9fe3a5e1ce3cb67debb52ae183b0785da

  • SHA256

    4f62184074f2f62c718f5905743e511839dd41ba62aa40650838f1b8b9f94c0a

  • SHA512

    83724ec00c836a93169a0306434a0269435461ab75dd8e4c0ac08349a776533093e7f7de91a0c82319796efe4f57c81a2507461723b718bb510d6ef54cc586e2

  • SSDEEP

    3072:SznkdnJr2TRllygV+BwjEktpmU31ArnFkZDd6aj6dzON:SziolIPmjltpm8WLFkZH6dzO

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

91.121.116.137:443

80.79.23.144:443

192.254.173.31:8080

190.108.228.48:990

94.205.247.10:80

85.54.169.141:8080

190.145.67.134:8090

63.142.253.122:8080

62.75.187.192:8080

185.14.187.201:8080

91.205.215.66:8080

80.11.163.139:443

92.233.128.13:143

186.4.172.5:8080

190.211.207.11:443

136.243.177.26:8080

85.104.59.244:20

87.230.19.21:8080

189.209.217.49:80

222.214.218.192:8080

rsa_pubkey.plain

Targets

    • Target

      ef00cd9b844f389d9f231018d86e9c32_JaffaCakes118

    • Size

      198KB

    • MD5

      ef00cd9b844f389d9f231018d86e9c32

    • SHA1

      0d3a7cc9fe3a5e1ce3cb67debb52ae183b0785da

    • SHA256

      4f62184074f2f62c718f5905743e511839dd41ba62aa40650838f1b8b9f94c0a

    • SHA512

      83724ec00c836a93169a0306434a0269435461ab75dd8e4c0ac08349a776533093e7f7de91a0c82319796efe4f57c81a2507461723b718bb510d6ef54cc586e2

    • SSDEEP

      3072:SznkdnJr2TRllygV+BwjEktpmU31ArnFkZDd6aj6dzON:SziolIPmjltpm8WLFkZH6dzO

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks