General

  • Target

    f9dbd9c6a4a43f1a153a83921d4c24b4_JaffaCakes118

  • Size

    544KB

  • Sample

    240927-gtfdzaycpm

  • MD5

    f9dbd9c6a4a43f1a153a83921d4c24b4

  • SHA1

    9ed2e627a35aeef7104c779f164ad9b34e32a8a1

  • SHA256

    b7303cbafb734022ffc4da77b9af377730cd8864ee962dccd0814676481534ba

  • SHA512

    f1b93b66c6f31d6ead494369afc90e3a9a94f790cb0149e070f6b300e27dec8d77d8bc7db67dab125f584459333fdf44638ee8ba2f7eb7d266fe89d3d116ef1b

  • SSDEEP

    6144:ATp3XYyIMYUTgOBeWoavwiU5yH5g222222222222K7bqPe:ATp3XYBUEOBeGwiUAp7bD

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

37.52.87.0:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

24.135.198.218:80

103.106.236.83:8080

219.92.13.25:80

89.32.150.160:8080

24.135.1.177:80

82.196.15.205:8080

190.147.137.153:443

170.81.48.2:80

51.159.23.217:443

77.55.211.77:8080

204.225.249.100:7080

191.182.6.118:80

188.2.217.94:80

61.92.159.208:8080

152.169.22.67:80

172.104.169.32:8080

rsa_pubkey.plain

Targets

    • Target

      f9dbd9c6a4a43f1a153a83921d4c24b4_JaffaCakes118

    • Size

      544KB

    • MD5

      f9dbd9c6a4a43f1a153a83921d4c24b4

    • SHA1

      9ed2e627a35aeef7104c779f164ad9b34e32a8a1

    • SHA256

      b7303cbafb734022ffc4da77b9af377730cd8864ee962dccd0814676481534ba

    • SHA512

      f1b93b66c6f31d6ead494369afc90e3a9a94f790cb0149e070f6b300e27dec8d77d8bc7db67dab125f584459333fdf44638ee8ba2f7eb7d266fe89d3d116ef1b

    • SSDEEP

      6144:ATp3XYyIMYUTgOBeWoavwiU5yH5g222222222222K7bqPe:ATp3XYBUEOBeGwiUAp7bD

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks