General

  • Target

    f1e314632b8671005de130045664c1b9_JaffaCakes118

  • Size

    212KB

  • Sample

    240922-m39xtswdkr

  • MD5

    f1e314632b8671005de130045664c1b9

  • SHA1

    a457cff23bb4bafa50853352bfe9b547b109543f

  • SHA256

    30a3b5a2f5cbc13c3419652834ae9296d47488124d6756f136be99230bd663b9

  • SHA512

    f57dae2d070c98c217c1075e2f7f2f8dfa6c454ac29c332ee200425c47bc0247d08f943fef01af392017bfe9d56fa800c3e1725dbdd5c8fa0bd77ef5de739a49

  • SSDEEP

    6144:NKdlKfKV7SI9wolCce3AD4amQd9t+qyly:rf8ZwolCRaxA5y

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

49.243.9.118:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

86.57.216.23:80

202.166.170.43:80

118.243.83.70:80

36.91.44.183:80

118.33.121.37:80

116.202.10.123:8080

113.193.239.51:443

169.1.211.133:80

192.163.221.191:8080

115.79.59.157:80

51.38.201.19:7080

45.177.120.37:8080

190.194.12.132:80

185.80.172.199:80

128.106.187.110:80

73.55.128.120:80

rsa_pubkey.plain

Targets

    • Target

      f1e314632b8671005de130045664c1b9_JaffaCakes118

    • Size

      212KB

    • MD5

      f1e314632b8671005de130045664c1b9

    • SHA1

      a457cff23bb4bafa50853352bfe9b547b109543f

    • SHA256

      30a3b5a2f5cbc13c3419652834ae9296d47488124d6756f136be99230bd663b9

    • SHA512

      f57dae2d070c98c217c1075e2f7f2f8dfa6c454ac29c332ee200425c47bc0247d08f943fef01af392017bfe9d56fa800c3e1725dbdd5c8fa0bd77ef5de739a49

    • SSDEEP

      6144:NKdlKfKV7SI9wolCce3AD4amQd9t+qyly:rf8ZwolCRaxA5y

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks