General

  • Target

    bc9213b97690c20fff1339780476b612_JaffaCakes118

  • Size

    188KB

  • Sample

    240618-se5absydrf

  • MD5

    bc9213b97690c20fff1339780476b612

  • SHA1

    6d22d00194277edb436bada66e74c4cc04a8cf95

  • SHA256

    0e722ea18d09d2b0fa787d6e29e5e434a2d1689e4cd8d2c4e1859d5c61010cda

  • SHA512

    88aeed3f0528ea29b2c820f5fb84972e1928f26a702f101f9b57c1c01f43bc1230fdf794740173fffb1ad4e54e5051127d50a6742a40df8f516f665c6c05465d

  • SSDEEP

    3072:8MoshaaeLI1bFDQ+zdISZCmbcwaQoCU/DCWtUOIgarjhxDrW5RSJxQEJE:XoyQyb1RRISZLJHyrCGUOI1v7CYb

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.219.172.26:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

194.187.133.160:443

104.236.246.93:8080

74.208.45.104:8080

78.187.156.31:80

187.161.206.24:80

94.23.216.33:80

172.91.208.86:80

91.211.88.52:7080

50.91.114.38:80

200.123.150.89:443

121.124.124.40:7080

62.75.141.82:80

5.196.74.210:8080

24.137.76.62:80

85.105.205.77:8080

139.130.242.43:80

rsa_pubkey.plain

Targets

    • Target

      bc9213b97690c20fff1339780476b612_JaffaCakes118

    • Size

      188KB

    • MD5

      bc9213b97690c20fff1339780476b612

    • SHA1

      6d22d00194277edb436bada66e74c4cc04a8cf95

    • SHA256

      0e722ea18d09d2b0fa787d6e29e5e434a2d1689e4cd8d2c4e1859d5c61010cda

    • SHA512

      88aeed3f0528ea29b2c820f5fb84972e1928f26a702f101f9b57c1c01f43bc1230fdf794740173fffb1ad4e54e5051127d50a6742a40df8f516f665c6c05465d

    • SSDEEP

      3072:8MoshaaeLI1bFDQ+zdISZCmbcwaQoCU/DCWtUOIgarjhxDrW5RSJxQEJE:XoyQyb1RRISZLJHyrCGUOI1v7CYb

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks