General

  • Target

    f4d9b35998c8c660954e746b500afd05_JaffaCakes118

  • Size

    327KB

  • Sample

    240925-blp1jswcqj

  • MD5

    f4d9b35998c8c660954e746b500afd05

  • SHA1

    45a13d774ab1f59e7310bbd26db6e997ce7b71e7

  • SHA256

    b0874f8b90ffe9cde1b20c13a8212089d50249b5ef79cc8a78ea22355fad9fdf

  • SHA512

    cacf22552ba9678ebda92d629447448fa8042536457e17f0d5b0742dfeece7708cb45d1f91187385d1cc833d0d57cc3a776c9e80e9fe0c310c9a9c9ba6824ecb

  • SSDEEP

    6144:Etm2wPZvZsPvTjGauXXZzHC1nHaT7XVOk0fV2MhUD5fnIzoez+wR8s:r2vTqjC1nHI7KfQMhB+wz

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

192.158.216.73:80

85.214.28.226:8080

142.44.137.67:443

162.241.242.173:8080

85.152.162.105:80

62.30.7.67:443

78.24.219.147:8080

74.120.55.163:80

169.239.182.217:8080

216.208.76.186:80

95.213.236.64:8080

200.114.213.233:8080

104.131.44.150:8080

70.121.172.89:80

75.139.38.211:80

185.94.252.104:443

97.82.79.83:80

103.86.49.11:8080

79.98.24.39:8080

83.169.36.251:8080

rsa_pubkey.plain

Targets

    • Target

      f4d9b35998c8c660954e746b500afd05_JaffaCakes118

    • Size

      327KB

    • MD5

      f4d9b35998c8c660954e746b500afd05

    • SHA1

      45a13d774ab1f59e7310bbd26db6e997ce7b71e7

    • SHA256

      b0874f8b90ffe9cde1b20c13a8212089d50249b5ef79cc8a78ea22355fad9fdf

    • SHA512

      cacf22552ba9678ebda92d629447448fa8042536457e17f0d5b0742dfeece7708cb45d1f91187385d1cc833d0d57cc3a776c9e80e9fe0c310c9a9c9ba6824ecb

    • SSDEEP

      6144:Etm2wPZvZsPvTjGauXXZzHC1nHaT7XVOk0fV2MhUD5fnIzoez+wR8s:r2vTqjC1nHI7KfQMhB+wz

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks