General

  • Target

    JaffaCakes118_d2d03792ec86ec40957083cbc15b6ed4f4e32c0e612c47e4f0bde909fca13954

  • Size

    174KB

  • Sample

    241229-myhb1szlhq

  • MD5

    f6542218d6c392bdab7e52a2b26f0db1

  • SHA1

    bb452ba79a0dcc7916fa32ba92e9504dd91b4171

  • SHA256

    d2d03792ec86ec40957083cbc15b6ed4f4e32c0e612c47e4f0bde909fca13954

  • SHA512

    f23ddd70e4071bca3a3efd429bc56feee8c7d2c9c1042cda44625d4d959e84a913107ee9e1b805d074000a8d4d4ee745985205749a36ab63e4d54b189606b323

  • SSDEEP

    3072:5AYnGS6+1scqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1q4sVOeKSJ+X7hB/dFV

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      JaffaCakes118_d2d03792ec86ec40957083cbc15b6ed4f4e32c0e612c47e4f0bde909fca13954

    • Size

      174KB

    • MD5

      f6542218d6c392bdab7e52a2b26f0db1

    • SHA1

      bb452ba79a0dcc7916fa32ba92e9504dd91b4171

    • SHA256

      d2d03792ec86ec40957083cbc15b6ed4f4e32c0e612c47e4f0bde909fca13954

    • SHA512

      f23ddd70e4071bca3a3efd429bc56feee8c7d2c9c1042cda44625d4d959e84a913107ee9e1b805d074000a8d4d4ee745985205749a36ab63e4d54b189606b323

    • SSDEEP

      3072:5AYnGS6+1scqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1q4sVOeKSJ+X7hB/dFV

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks