General

  • Target

    fdee7b51cef40dce0dd5660f28712f51_JaffaCakes118

  • Size

    408KB

  • Sample

    240929-grz1lascjj

  • MD5

    fdee7b51cef40dce0dd5660f28712f51

  • SHA1

    c26ae4f194bb0d0d97ec287eceea8befbd605e62

  • SHA256

    dd2848d0483ffa81f7fd0648a808e86ac6fbc5819c15f8db0f5c434891f56a9d

  • SHA512

    5b66b8481b60688218b5aeed3fae0afa354760a34dc2f8e627d7ec070ec2473d2187c52bbcb26b0a4cc8a4dfca8b5d71f192f5f2bb862dab56558f8c21cff152

  • SSDEEP

    6144:3nOIweNMFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweNke1yOfH8sEQSs2ax

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

128.92.203.42:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

190.188.245.242:80

12.163.208.58:80

213.197.182.158:8080

201.213.177.139:80

62.84.75.50:80

45.33.77.42:8080

185.183.16.47:80

78.249.119.122:80

177.129.17.170:443

51.15.7.189:80

152.169.22.67:80

119.106.216.84:80

109.169.12.78:80

51.15.7.145:80

219.92.13.25:80

190.117.79.209:80

rsa_pubkey.plain

Targets

    • Target

      fdee7b51cef40dce0dd5660f28712f51_JaffaCakes118

    • Size

      408KB

    • MD5

      fdee7b51cef40dce0dd5660f28712f51

    • SHA1

      c26ae4f194bb0d0d97ec287eceea8befbd605e62

    • SHA256

      dd2848d0483ffa81f7fd0648a808e86ac6fbc5819c15f8db0f5c434891f56a9d

    • SHA512

      5b66b8481b60688218b5aeed3fae0afa354760a34dc2f8e627d7ec070ec2473d2187c52bbcb26b0a4cc8a4dfca8b5d71f192f5f2bb862dab56558f8c21cff152

    • SSDEEP

      6144:3nOIweNMFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweNke1yOfH8sEQSs2ax

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks