General

  • Target

    23b4c1ca292b603acdae670c038a101a_JaffaCakes118

  • Size

    346KB

  • Sample

    240703-2m6b2azcpj

  • MD5

    23b4c1ca292b603acdae670c038a101a

  • SHA1

    2843ff081c0d7a7d537c5dccd5f881040d3999be

  • SHA256

    fc03540c6d3112c5fadd011926d576ea6e0df390d9c923f3b7519e52f63eb290

  • SHA512

    f499ea27f78f69b6532b383a26f19c6b4bff5d8ecf2db4baec640a72ea568ec633e73ce8997316c4e7a0a07c50bf40a3bda29d7e01c37a89771328013cdef087

  • SSDEEP

    6144:NOJfZe/eEoJI5TUd13ONORbFX/MeUy0ixee3je/586763EApVAQHBuBNmOdTSIuL:NOJs/DoJ93ON+Xkc3Tpn

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

74.208.74.92:8080

89.32.150.160:8080

80.240.141.141:7080

151.80.142.33:80

5.196.35.138:7080

200.58.171.51:80

81.213.215.216:50000

187.150.150.127:7080

149.62.173.247:8080

62.75.160.178:8080

170.84.133.72:8443

79.129.0.173:8080

181.29.101.13:8080

183.82.97.25:80

109.104.79.48:8080

201.199.93.30:443

159.203.204.126:8080

181.36.42.205:443

46.28.111.142:7080

178.249.187.151:8080

rsa_pubkey.plain

Targets

    • Target

      23b4c1ca292b603acdae670c038a101a_JaffaCakes118

    • Size

      346KB

    • MD5

      23b4c1ca292b603acdae670c038a101a

    • SHA1

      2843ff081c0d7a7d537c5dccd5f881040d3999be

    • SHA256

      fc03540c6d3112c5fadd011926d576ea6e0df390d9c923f3b7519e52f63eb290

    • SHA512

      f499ea27f78f69b6532b383a26f19c6b4bff5d8ecf2db4baec640a72ea568ec633e73ce8997316c4e7a0a07c50bf40a3bda29d7e01c37a89771328013cdef087

    • SSDEEP

      6144:NOJfZe/eEoJI5TUd13ONORbFX/MeUy0ixee3je/586763EApVAQHBuBNmOdTSIuL:NOJs/DoJ93ON+Xkc3Tpn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks