Overview

overview

10

Static

static

3

0441fa756e...18.exe

windows7-x64

10

0441fa756e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0441fa756e426129eb9665f3c48a60b8_JaffaCakes118

  • Size

    352KB

  • Sample

    240428-dspz8seh49

  • MD5

    0441fa756e426129eb9665f3c48a60b8

  • SHA1

    62dc0cc93d78d4acda6e8101d36e56b89d0a0d85

  • SHA256

    657f8b3053328137655a125096e18e83baef2a24763a0e58bb1a079325180f31

  • SHA512

    6654a33e88d0e002ea491ff3d4819ee94cab021347179b87320f285f9fac4ccf1d916c5c5ff4f1eeca801d082ae917feba62ce4527bf9a35ff9fb32527d3ceda

  • SSDEEP

    6144:UYu13J/YyrGwoebB4dzapqUHTTBoGhUWnSQaBE6KHb:UYu13JgyKwradza0UDRna6Hb

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

104.236.137.72:8080

172.104.233.225:8080

81.169.140.14:443

213.189.36.51:8080

87.106.77.40:7080

86.42.166.147:80

200.113.106.18:80

45.79.95.107:443

125.99.61.162:7080

181.16.17.210:443

207.154.204.40:8080

91.204.163.19:8090

201.190.133.235:8080

91.83.93.124:7080

163.172.40.218:7080

149.62.173.247:8080

189.173.113.67:443

68.183.190.199:8080

190.210.184.138:995

142.127.57.63:8080
rsa_pubkey.plain

Targets

    • Target

      0441fa756e426129eb9665f3c48a60b8_JaffaCakes118

    • Size

      352KB

    • MD5

      0441fa756e426129eb9665f3c48a60b8

    • SHA1

      62dc0cc93d78d4acda6e8101d36e56b89d0a0d85

    • SHA256

      657f8b3053328137655a125096e18e83baef2a24763a0e58bb1a079325180f31

    • SHA512

      6654a33e88d0e002ea491ff3d4819ee94cab021347179b87320f285f9fac4ccf1d916c5c5ff4f1eeca801d082ae917feba62ce4527bf9a35ff9fb32527d3ceda

    • SSDEEP

      6144:UYu13J/YyrGwoebB4dzapqUHTTBoGhUWnSQaBE6KHb:UYu13JgyKwradza0UDRna6Hb

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks