General

  • Target

    fbd3b0a1c703a9fd144a6cfdedf9dcce_JaffaCakes118

  • Size

    244KB

  • Sample

    240928-jmrjrsvanj

  • MD5

    fbd3b0a1c703a9fd144a6cfdedf9dcce

  • SHA1

    9720b2ac55633721f39516d1ca25b2fb695b6479

  • SHA256

    b4418c137838dc1644fd6ce1ff71e879ba5afde6ddf028a64cd17d14dd31ebf6

  • SHA512

    5f0809df6cb04fdc8619b7285ee634b8159955c046161cd843ed9c29f1eca273c16c6265d20cb24bff7e936795ee82f4fa2fc7f7b5b8a627f3187b7be6540987

  • SSDEEP

    1536:B1pOLlbFRiweT6woR6hLZr2lZs6H71QdlauoBQIlQIlQIlQIlQIlQIlQIlQIlQIT:BjQlpRi39Mm+sQ71QdlauoQzxHIIMzZr

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

71.197.211.156:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

213.60.96.117:80

188.2.217.94:80

174.100.27.229:80

46.28.111.142:7080

186.103.141.250:443

207.144.103.227:80

110.142.219.51:80

70.32.84.74:8080

70.32.115.157:8080

111.67.12.221:8080

219.92.13.25:80

149.62.173.247:8080

177.72.13.80:80

77.238.212.227:80

5.196.35.138:7080

114.109.179.60:80

rsa_pubkey.plain

Targets

    • Target

      fbd3b0a1c703a9fd144a6cfdedf9dcce_JaffaCakes118

    • Size

      244KB

    • MD5

      fbd3b0a1c703a9fd144a6cfdedf9dcce

    • SHA1

      9720b2ac55633721f39516d1ca25b2fb695b6479

    • SHA256

      b4418c137838dc1644fd6ce1ff71e879ba5afde6ddf028a64cd17d14dd31ebf6

    • SHA512

      5f0809df6cb04fdc8619b7285ee634b8159955c046161cd843ed9c29f1eca273c16c6265d20cb24bff7e936795ee82f4fa2fc7f7b5b8a627f3187b7be6540987

    • SSDEEP

      1536:B1pOLlbFRiweT6woR6hLZr2lZs6H71QdlauoBQIlQIlQIlQIlQIlQIlQIlQIlQIT:BjQlpRi39Mm+sQ71QdlauoQzxHIIMzZr

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Enterprise v15

Tasks