General

  • Target

    f5f32966481bcbe5a207ca150b5d40d0_JaffaCakes118

  • Size

    272KB

  • Sample

    240925-n1lb5axbna

  • MD5

    f5f32966481bcbe5a207ca150b5d40d0

  • SHA1

    0c7e2d127273e557c24536d99b514e59ddee0cab

  • SHA256

    3a9cd442e209cf4f2b0053f17fc2d7108d2aa24fff7b4a1eb9f67630a198ef95

  • SHA512

    7f55a8dd9056e5c179c6a58c8f65e158111810a1a3a6bb1187ddfe54f2eb8b6ab3cc78114e2af84a07fb604bee7126f3b2d3164d01cf747ced173e5d069e2226

  • SSDEEP

    6144:AIFpoLPsjOe5Rq2btO4oKAOpK+z32E2UomN25:hOe5A2gO0G7N25

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

49.243.9.118:80

162.241.41.111:7080

190.85.46.52:7080

162.144.42.60:8080

157.245.138.101:7080

103.133.66.57:443

167.71.227.113:8080

80.200.62.81:20

78.186.65.230:80

185.142.236.163:443

78.114.175.216:80

202.166.170.43:80

37.205.9.252:7080

118.243.83.70:80

116.202.10.123:8080

223.135.30.189:80

120.51.34.254:80

139.59.61.215:443

8.4.9.137:8080

202.153.220.157:80

rsa_pubkey.plain

Targets

    • Target

      f5f32966481bcbe5a207ca150b5d40d0_JaffaCakes118

    • Size

      272KB

    • MD5

      f5f32966481bcbe5a207ca150b5d40d0

    • SHA1

      0c7e2d127273e557c24536d99b514e59ddee0cab

    • SHA256

      3a9cd442e209cf4f2b0053f17fc2d7108d2aa24fff7b4a1eb9f67630a198ef95

    • SHA512

      7f55a8dd9056e5c179c6a58c8f65e158111810a1a3a6bb1187ddfe54f2eb8b6ab3cc78114e2af84a07fb604bee7126f3b2d3164d01cf747ced173e5d069e2226

    • SSDEEP

      6144:AIFpoLPsjOe5Rq2btO4oKAOpK+z32E2UomN25:hOe5A2gO0G7N25

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks