General

  • Target

    f2cf1e1f6d8a675e1cff0a39f10e7caf_JaffaCakes118

  • Size

    220KB

  • Sample

    240923-wgh2naygkc

  • MD5

    f2cf1e1f6d8a675e1cff0a39f10e7caf

  • SHA1

    798512a2449cf6f00d2de2e18e296b535ff02ee3

  • SHA256

    c0f6fc5b7e0d8afba8e044dc5a17dc2304e2761edeb8430a9c8e29c9a70bcd63

  • SHA512

    bd523f25e773ad690934612c48d1dcdd072317771394a0b38ff57a7e9060624b3c9420817b69b18b6bad7512a441c5dd3f7e04d3b42c2edf5a7a0124f1e6ccc3

  • SSDEEP

    3072:1mNXdDFrtXx7bZKxehc4bjLwEe/IN0r6flblNvakKHMxpNqWQ+xIYXD:mNxrtXRbQqvLXegc6dPa7

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Targets

    • Target

      f2cf1e1f6d8a675e1cff0a39f10e7caf_JaffaCakes118

    • Size

      220KB

    • MD5

      f2cf1e1f6d8a675e1cff0a39f10e7caf

    • SHA1

      798512a2449cf6f00d2de2e18e296b535ff02ee3

    • SHA256

      c0f6fc5b7e0d8afba8e044dc5a17dc2304e2761edeb8430a9c8e29c9a70bcd63

    • SHA512

      bd523f25e773ad690934612c48d1dcdd072317771394a0b38ff57a7e9060624b3c9420817b69b18b6bad7512a441c5dd3f7e04d3b42c2edf5a7a0124f1e6ccc3

    • SSDEEP

      3072:1mNXdDFrtXx7bZKxehc4bjLwEe/IN0r6flblNvakKHMxpNqWQ+xIYXD:mNxrtXRbQqvLXegc6dPa7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks