General

  • Target

    fac15fc604a4e25c90134b30f71975a2_JaffaCakes118

  • Size

    172KB

  • Sample

    240927-t25p2s1fpr

  • MD5

    fac15fc604a4e25c90134b30f71975a2

  • SHA1

    8fbb3d51f618bfc1096fc192628a6ce012e44d55

  • SHA256

    8dfbe693f194ecb9e08df2ee345c52600e9e5111f96c5ab518964dc5b284e58b

  • SHA512

    7f1bd1aabb3efe204457ff9971a5f02988e3860f542dbacc2f5904bda879394e831b89dcf53cb0ba94f84c0b58c04b93d2a7657debbdf70323dc6da1aa288167

  • SSDEEP

    3072:WrrsDIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrAIL8/Xatd54AddF8

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

223.133.20.171:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

58.27.215.3:8080

220.147.247.145:80

139.59.12.63:8080

185.142.236.163:443

113.156.82.32:80

126.126.139.26:443

198.57.203.63:8080

181.137.229.1:80

95.216.205.155:8080

37.187.100.220:7080

50.116.78.109:8080

37.205.9.252:7080

172.105.78.244:8080

103.133.66.57:443

91.75.75.46:80

46.105.131.68:8080

rsa_pubkey.plain

Targets

    • Target

      fac15fc604a4e25c90134b30f71975a2_JaffaCakes118

    • Size

      172KB

    • MD5

      fac15fc604a4e25c90134b30f71975a2

    • SHA1

      8fbb3d51f618bfc1096fc192628a6ce012e44d55

    • SHA256

      8dfbe693f194ecb9e08df2ee345c52600e9e5111f96c5ab518964dc5b284e58b

    • SHA512

      7f1bd1aabb3efe204457ff9971a5f02988e3860f542dbacc2f5904bda879394e831b89dcf53cb0ba94f84c0b58c04b93d2a7657debbdf70323dc6da1aa288167

    • SSDEEP

      3072:WrrsDIL9C/sjz9eatIS5bSBAsuU1yFvvOQy:WrrAIL8/Xatd54AddF8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks