General

  • Target

    0b574e06627b6a3396d6ad596c29c2cd_JaffaCakes118

  • Size

    348KB

  • Sample

    240624-3r2ebaydkg

  • MD5

    0b574e06627b6a3396d6ad596c29c2cd

  • SHA1

    1e541ae5debcd981072551ed45ca8a9690a12b9e

  • SHA256

    4e1fae029bf6aab4e61768c90f5ac748027c7388a5bc2d62768197b73cfee260

  • SHA512

    f8236da4ca84d34d8d565a4c8428105a4a8febfd3bfa65f81349ecf0616335f9a8ec5f8bd0165667b5b61a8769b388fbca370cfa4571ca2a9d181113b87d662d

  • SSDEEP

    3072:ka99Ky1S0SD8MHjO73Ba01/H/7FlwZ2RJJBvX+WUEAQbb:kaGy1nS8MHi7xai73JtkWUEAKb

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.10.46.92:80

2.58.16.88:8080

206.189.232.2:8080

178.250.54.208:8080

167.71.148.58:443

202.134.4.210:7080

187.162.248.237:80

78.206.229.130:80

85.214.26.7:8080

5.196.35.138:7080

1.226.84.243:8080

110.39.162.2:443

185.183.16.47:80

152.231.89.226:80

138.97.60.141:7080

94.176.234.118:443

46.101.58.37:8080

93.146.143.191:80

70.32.84.74:8080

137.74.106.111:7080

rsa_pubkey.plain

Targets

    • Target

      0b574e06627b6a3396d6ad596c29c2cd_JaffaCakes118

    • Size

      348KB

    • MD5

      0b574e06627b6a3396d6ad596c29c2cd

    • SHA1

      1e541ae5debcd981072551ed45ca8a9690a12b9e

    • SHA256

      4e1fae029bf6aab4e61768c90f5ac748027c7388a5bc2d62768197b73cfee260

    • SHA512

      f8236da4ca84d34d8d565a4c8428105a4a8febfd3bfa65f81349ecf0616335f9a8ec5f8bd0165667b5b61a8769b388fbca370cfa4571ca2a9d181113b87d662d

    • SSDEEP

      3072:ka99Ky1S0SD8MHjO73Ba01/H/7FlwZ2RJJBvX+WUEAQbb:kaGy1nS8MHi7xai73JtkWUEAKb

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks