General

  • Target

    b8ad276e17ae1c4acf76b9834bbfdf67_JaffaCakes118

  • Size

    620KB

  • Sample

    240617-pyanaavgpq

  • MD5

    b8ad276e17ae1c4acf76b9834bbfdf67

  • SHA1

    d180127245d9404ea68473688fbf77273fe078b7

  • SHA256

    c9ffe8decf28b54d492fe57bc9dda19b9770231a0fe4182b30393fd97495ad28

  • SHA512

    b8886c4625c77be70b057e1c17d81dbe7fe119710ec2b29adbbc189946c86f5cf022a541b9f7c787f5c32749ead90549050feea8e7615596bbf425d60cecb737

  • SSDEEP

    6144:oGNVz9kp5zQVxbH+dW8JFEc6c6ckNiNIDKWy:oUVpkp5zQVxbH+zGFy

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

67.68.210.95:80

162.241.242.173:8080

45.55.36.51:443

45.55.219.163:443

68.188.112.97:80

46.105.131.79:8080

78.24.219.147:8080

37.70.8.161:80

153.232.188.106:80

209.141.54.221:8080

203.117.253.142:80

152.168.248.128:443

93.147.212.206:80

24.137.76.62:80

189.212.199.126:443

204.197.146.48:80

137.119.36.33:80

185.94.252.104:443

139.130.242.43:80

203.153.216.189:7080

rsa_pubkey.plain

Targets

    • Target

      b8ad276e17ae1c4acf76b9834bbfdf67_JaffaCakes118

    • Size

      620KB

    • MD5

      b8ad276e17ae1c4acf76b9834bbfdf67

    • SHA1

      d180127245d9404ea68473688fbf77273fe078b7

    • SHA256

      c9ffe8decf28b54d492fe57bc9dda19b9770231a0fe4182b30393fd97495ad28

    • SHA512

      b8886c4625c77be70b057e1c17d81dbe7fe119710ec2b29adbbc189946c86f5cf022a541b9f7c787f5c32749ead90549050feea8e7615596bbf425d60cecb737

    • SSDEEP

      6144:oGNVz9kp5zQVxbH+dW8JFEc6c6ckNiNIDKWy:oUVpkp5zQVxbH+zGFy

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks