General

  • Target

    JaffaCakes118_e9a370aa7c2f48d82be7ced29e57a0abe99a6f5ed854130b1a9ac5950318ce80

  • Size

    432KB

  • Sample

    241229-ef1rms1rfp

  • MD5

    0598691fb39419103a491fc5a46ad3d8

  • SHA1

    64ac7a02ec4707c2986db224910477176de1f29f

  • SHA256

    e9a370aa7c2f48d82be7ced29e57a0abe99a6f5ed854130b1a9ac5950318ce80

  • SHA512

    665f660912be0a3b3feb7616377377b47111e3df3bf6f5003e6db3e48d3b34a4c53326b19f573d85e43098adacd53ea818f9a44d43105743e1693c6bc67d9dd2

  • SSDEEP

    12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJcXViQjnbbyADuCgs:rk2E1kEi1asBqCM70iQjbFuO

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.231.88.85:80

191.112.178.60:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

74.40.205.197:443

62.75.141.82:80

2.58.16.89:8080

188.219.31.12:80

95.213.236.64:8080

72.186.136.247:443

185.201.9.197:8080

203.153.216.189:7080

202.134.4.216:8080

72.229.97.235:80

24.179.13.119:80

174.118.202.24:443

74.208.45.104:8080

51.89.36.180:443

202.141.243.254:443

rsa_pubkey.plain

Targets

    • Target

      JaffaCakes118_e9a370aa7c2f48d82be7ced29e57a0abe99a6f5ed854130b1a9ac5950318ce80

    • Size

      432KB

    • MD5

      0598691fb39419103a491fc5a46ad3d8

    • SHA1

      64ac7a02ec4707c2986db224910477176de1f29f

    • SHA256

      e9a370aa7c2f48d82be7ced29e57a0abe99a6f5ed854130b1a9ac5950318ce80

    • SHA512

      665f660912be0a3b3feb7616377377b47111e3df3bf6f5003e6db3e48d3b34a4c53326b19f573d85e43098adacd53ea818f9a44d43105743e1693c6bc67d9dd2

    • SSDEEP

      12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJcXViQjnbbyADuCgs:rk2E1kEi1asBqCM70iQjbFuO

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks