General

  • Target

    ac6627ae052f3ae7968cca60e4219905_JaffaCakes118

  • Size

    308KB

  • Sample

    240615-btr5wathkd

  • MD5

    ac6627ae052f3ae7968cca60e4219905

  • SHA1

    5d3a660a5eb9c96e0bc2b6e7c96b21889e95aec5

  • SHA256

    cd6be3700babd575f736ba8b5dbcb200a79e68588379a5940a4f34a2826627ea

  • SHA512

    3e1b3b94d3251cbd66735a35c699a6718ca90178eeed91cd0b0ccd12c4569f075b4dae3d38a42a296fd46a59d1cf642616d3e52068261826cc051b5abc9e71a6

  • SSDEEP

    6144:TqfI2dK4las/gMXzGnZq/TVbY7/qyPoNIZAFJi:TqfIJ4lxgMXyUdskIiW

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

70.121.172.89:80

116.202.234.183:8080

69.30.203.214:8080

185.94.252.104:443

64.183.73.122:80

190.55.181.54:443

37.70.8.161:80

174.137.65.18:80

203.153.216.189:7080

109.116.214.124:443

93.51.50.171:8080

190.160.53.126:80

222.214.218.37:4143

87.106.136.232:8080

113.160.130.116:8443

174.102.48.180:80

79.98.24.39:8080

189.212.199.126:443

89.186.91.200:443

24.233.112.152:80

rsa_pubkey.plain

Targets

    • Target

      ac6627ae052f3ae7968cca60e4219905_JaffaCakes118

    • Size

      308KB

    • MD5

      ac6627ae052f3ae7968cca60e4219905

    • SHA1

      5d3a660a5eb9c96e0bc2b6e7c96b21889e95aec5

    • SHA256

      cd6be3700babd575f736ba8b5dbcb200a79e68588379a5940a4f34a2826627ea

    • SHA512

      3e1b3b94d3251cbd66735a35c699a6718ca90178eeed91cd0b0ccd12c4569f075b4dae3d38a42a296fd46a59d1cf642616d3e52068261826cc051b5abc9e71a6

    • SSDEEP

      6144:TqfI2dK4las/gMXzGnZq/TVbY7/qyPoNIZAFJi:TqfIJ4lxgMXyUdskIiW

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks