General

  • Target

    f3c041400a6999c1733eaba09ea853b9_JaffaCakes118

  • Size

    240KB

  • Sample

    240924-qtgfpswhqn

  • MD5

    f3c041400a6999c1733eaba09ea853b9

  • SHA1

    b1855f489014cb34e40cf24da660c109bf21bcdb

  • SHA256

    09a562ede9722dbeb65d2d23e56ba2588bdb14be09f3aa36a9cee68027370cfa

  • SHA512

    2769b5fa8ef8eec2bc267ab06b99bdb1e979c934ac569439dfeb22717b720728af2030808a0c6d7362c6cd7757c39e8e1dee50ca2743e62f4efa96434f183a32

  • SSDEEP

    3072:/k765gyVWFr/7af9eoRht2jAalu5VGNNBX03jo608hurwTZWf/3:cZmWN/7KQRjkaNXk3joehNW3

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

12.163.208.58:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

192.241.146.84:8080

74.58.215.226:80

199.203.62.165:80

185.94.252.27:443

174.113.69.136:80

46.43.2.95:8080

50.121.220.50:80

192.81.38.31:80

51.38.124.206:80

76.168.54.203:80

51.75.33.127:80

189.2.177.210:443

77.106.157.34:8080

45.33.77.42:8080

178.250.54.208:8080

5.196.35.138:7080

rsa_pubkey.plain

Targets

    • Target

      f3c041400a6999c1733eaba09ea853b9_JaffaCakes118

    • Size

      240KB

    • MD5

      f3c041400a6999c1733eaba09ea853b9

    • SHA1

      b1855f489014cb34e40cf24da660c109bf21bcdb

    • SHA256

      09a562ede9722dbeb65d2d23e56ba2588bdb14be09f3aa36a9cee68027370cfa

    • SHA512

      2769b5fa8ef8eec2bc267ab06b99bdb1e979c934ac569439dfeb22717b720728af2030808a0c6d7362c6cd7757c39e8e1dee50ca2743e62f4efa96434f183a32

    • SSDEEP

      3072:/k765gyVWFr/7af9eoRht2jAalu5VGNNBX03jo608hurwTZWf/3:cZmWN/7KQRjkaNXk3joehNW3

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks