General
-
Target
JaffaCakes118_7cd7cbe364c9c32c69baa025bdbca85a39aa8d90fbbfd2baa51e6fe89c4e2387
-
Size
358KB
-
Sample
241227-a13phswrbn
-
MD5
aabf2f31aa9f7888f3a71e3e5e3cd649
-
SHA1
3aa3efeeb7663c489c40e36a87f33f05eb68e69f
-
SHA256
7cd7cbe364c9c32c69baa025bdbca85a39aa8d90fbbfd2baa51e6fe89c4e2387
-
SHA512
2b95c714c0cdd5ffbe6579af75065512544e25f1fd4fbcd689c025423f7f4f3dd34a156007727df6e55dcfafd5802fb87ca967a8e1edc81ba107d758c94ede96
-
SSDEEP
6144:FK8pvXWSWy0QwJ/reZ2GRGCByiCiXl52yYAEqLJKytZcE57KLEYdhguVS8X1YKc:FlpvXWgmCAGRGcy+5OuTh5HYdhgm2p
Malware Config
Extracted
emotet
Epoch5
51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
Targets
-
-
Target
0d6f49c38dfd1f19dc8e87f0d927a594aa9a1a748a1dfd03ba927d1bded531ce
-
Size
640KB
-
MD5
062c7570e794515f7872ed2f19362d42
-
SHA1
f6ba10cc52613a33680012fa1e6bdf38ed774a84
-
SHA256
0d6f49c38dfd1f19dc8e87f0d927a594aa9a1a748a1dfd03ba927d1bded531ce
-
SHA512
f97f3359faa1a288aab3c62771cf4e26034cbae98a97a06dd94f88d042e55bcb4f358f261b88b5e30f6108c1bf79415d1b9e54a6d3667ce8d63a3dae2236ff39
-
SSDEEP
12288:ivpO7ru2TDuk1tYTwwe5AnYq2JaiMMMXdgir7OOBgzgENENENEn+ITITInTKTx4y:vru233dweOnYq2JaiMMMNgir7OOBgzg8
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Loads dropped DLL
-
Drops file in System32 directory
-