General

  • Target

    b667d95eb7bb68cb705d4e03ec3c82e0_JaffaCakes118

  • Size

    603KB

  • Sample

    240617-c436kazhmh

  • MD5

    b667d95eb7bb68cb705d4e03ec3c82e0

  • SHA1

    c8f50e51260dd21469da203fe630171695c0cd47

  • SHA256

    d67ffbff735113dee6060136bbe9d0f6d44a3026a2f4b57285ffeed2ce39cf61

  • SHA512

    e14bb85150bd66f43e64c309b9019a4d9536709b8c3f190fcd39609d061230315d07a02af3c6cb0e5c933af4d179dd97f3fbb196cf95897e1db8440cf00c73c3

  • SSDEEP

    12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080

rsa_pubkey.plain

Targets

    • Target

      b667d95eb7bb68cb705d4e03ec3c82e0_JaffaCakes118

    • Size

      603KB

    • MD5

      b667d95eb7bb68cb705d4e03ec3c82e0

    • SHA1

      c8f50e51260dd21469da203fe630171695c0cd47

    • SHA256

      d67ffbff735113dee6060136bbe9d0f6d44a3026a2f4b57285ffeed2ce39cf61

    • SHA512

      e14bb85150bd66f43e64c309b9019a4d9536709b8c3f190fcd39609d061230315d07a02af3c6cb0e5c933af4d179dd97f3fbb196cf95897e1db8440cf00c73c3

    • SSDEEP

      12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks