General

  • Target

    ff63c2788ebf1fe806e794a3fd7396a8_JaffaCakes118

  • Size

    346KB

  • Sample

    240929-1324wawhpe

  • MD5

    ff63c2788ebf1fe806e794a3fd7396a8

  • SHA1

    f92f647639014f4c99b8a7a05c2474033bc35738

  • SHA256

    91fee4c3167cb62190368c309a24678ff73e203bfdc95acac61f8e130ac31f17

  • SHA512

    06d45d8664f6cf3aa36bf6b52ff3f85a5ad67aa3e7c5f03bc4d48b8fe7d9e0ffbd9819ff38fa6a9d12d974aeabd312536eddfed438b4e230a041bf269f263214

  • SSDEEP

    3072:t82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:m2L7HN7Kl/jLA90QECrYRpj

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

51.15.7.145:80

177.85.167.10:80

186.177.174.163:80

190.114.254.163:8080

185.183.16.47:80

149.202.72.142:7080

181.30.61.163:443

31.27.59.105:80

50.28.51.143:8080

68.183.190.199:8080

85.214.26.7:8080

137.74.106.111:7080

200.75.39.254:80

85.105.239.184:443

190.45.24.210:80

170.81.48.2:80

109.101.137.162:8080

rsa_pubkey.plain

Targets

    • Target

      ff63c2788ebf1fe806e794a3fd7396a8_JaffaCakes118

    • Size

      346KB

    • MD5

      ff63c2788ebf1fe806e794a3fd7396a8

    • SHA1

      f92f647639014f4c99b8a7a05c2474033bc35738

    • SHA256

      91fee4c3167cb62190368c309a24678ff73e203bfdc95acac61f8e130ac31f17

    • SHA512

      06d45d8664f6cf3aa36bf6b52ff3f85a5ad67aa3e7c5f03bc4d48b8fe7d9e0ffbd9819ff38fa6a9d12d974aeabd312536eddfed438b4e230a041bf269f263214

    • SSDEEP

      3072:t82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:m2L7HN7Kl/jLA90QECrYRpj

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks