General

  • Target

    f13fcd8c1e2b9b1de0a5c4ea3c41e235_JaffaCakes118

  • Size

    168KB

  • Sample

    240922-enz53s1ekc

  • MD5

    f13fcd8c1e2b9b1de0a5c4ea3c41e235

  • SHA1

    bf34160a8c7711cd80d5221045a4069f214f8cef

  • SHA256

    5dff947798fe26fff0ea1b1a3f851ac24c463eada35819e7eea098bf6b2bf27a

  • SHA512

    5d511ae9a3e465331e153b61595560093857b62fa0ee682d3aa54bd28ebd3449bcf3e97d0495bb410dbc11e877ef352238f48e7f5175e97e0b59938973d86963

  • SSDEEP

    1536:d3yCxVaZ7MWxaQhYNsm0UzgotgOTzSmndChvd/b9:tHxVaZg4INtyNhlb9

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

37.52.87.0:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

24.135.198.218:80

103.106.236.83:8080

219.92.13.25:80

89.32.150.160:8080

24.135.1.177:80

82.196.15.205:8080

190.147.137.153:443

170.81.48.2:80

51.159.23.217:443

77.55.211.77:8080

204.225.249.100:7080

191.182.6.118:80

188.2.217.94:80

61.92.159.208:8080

152.169.22.67:80

172.104.169.32:8080

rsa_pubkey.plain

Targets

    • Target

      f13fcd8c1e2b9b1de0a5c4ea3c41e235_JaffaCakes118

    • Size

      168KB

    • MD5

      f13fcd8c1e2b9b1de0a5c4ea3c41e235

    • SHA1

      bf34160a8c7711cd80d5221045a4069f214f8cef

    • SHA256

      5dff947798fe26fff0ea1b1a3f851ac24c463eada35819e7eea098bf6b2bf27a

    • SHA512

      5d511ae9a3e465331e153b61595560093857b62fa0ee682d3aa54bd28ebd3449bcf3e97d0495bb410dbc11e877ef352238f48e7f5175e97e0b59938973d86963

    • SSDEEP

      1536:d3yCxVaZ7MWxaQhYNsm0UzgotgOTzSmndChvd/b9:tHxVaZg4INtyNhlb9

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks