General

  • Target

    b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118

  • Size

    308KB

  • Sample

    240617-hhtynasgnp

  • MD5

    b73ff4bd2c42f3ae83e9a54dc961e775

  • SHA1

    b42270c0fc8af3d8ec5209d03d48af1075d1c059

  • SHA256

    c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26

  • SHA512

    d5531830e6c8f6c2a9956d62f3cadac081fcf0e935848625bd994ad94414ce57f22fdeb0bdd48ac83644c1b80df07044ade4714dfcd9012b1bc37a68c5c713b5

  • SSDEEP

    3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZe5:MPCum81YIPQMCuyDDlB25y4Ze5

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Targets

    • Target

      b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118

    • Size

      308KB

    • MD5

      b73ff4bd2c42f3ae83e9a54dc961e775

    • SHA1

      b42270c0fc8af3d8ec5209d03d48af1075d1c059

    • SHA256

      c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26

    • SHA512

      d5531830e6c8f6c2a9956d62f3cadac081fcf0e935848625bd994ad94414ce57f22fdeb0bdd48ac83644c1b80df07044ade4714dfcd9012b1bc37a68c5c713b5

    • SSDEEP

      3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZe5:MPCum81YIPQMCuyDDlB25y4Ze5

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks