Overview

overview

10

Static

static

3

0762440160...18.exe

windows7-x64

10

0762440160...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07624401604ff5ef8bb1e00c504b5030_JaffaCakes118

  • Size

    396KB

  • Sample

    240429-lx32nagc31

  • MD5

    07624401604ff5ef8bb1e00c504b5030

  • SHA1

    74b48fc4e4a5d2976146f5e630943507424801e6

  • SHA256

    c80646467b0b72ab888f136245982fc23d960d84b88319c929d10f1241c9d1e3

  • SHA512

    f339a78dfb653d7d2abb0b96c517364a8b31ef11f8f0459a23a17ac41a1c812307d7307f2cdc4ecb5ee45883bb3229e6533feb60e0179e1821df28ef3203cde8

  • SSDEEP

    6144:YpR42sUGyvBtBhVGIzgA2ssMenKFFW8fJTD45j+gmhy+mvVi+/G:stBttysVekQoZJgmhMYJ

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.129.24.79:8080

37.187.2.199:443

173.249.47.77:8080

182.176.132.213:8090

95.128.43.213:8080

190.145.67.134:8090

46.105.131.87:80

152.89.236.214:8080

190.53.135.159:21

103.39.131.88:80

198.199.114.69:8080

212.71.234.16:8080

206.189.98.125:8080

47.41.213.2:22

92.222.216.44:8080

169.239.182.217:8080

178.210.51.222:8080

67.225.229.55:8080

104.236.246.93:8080

69.164.201.54:8080
rsa_pubkey.plain

Targets

    • Target

      07624401604ff5ef8bb1e00c504b5030_JaffaCakes118

    • Size

      396KB

    • MD5

      07624401604ff5ef8bb1e00c504b5030

    • SHA1

      74b48fc4e4a5d2976146f5e630943507424801e6

    • SHA256

      c80646467b0b72ab888f136245982fc23d960d84b88319c929d10f1241c9d1e3

    • SHA512

      f339a78dfb653d7d2abb0b96c517364a8b31ef11f8f0459a23a17ac41a1c812307d7307f2cdc4ecb5ee45883bb3229e6533feb60e0179e1821df28ef3203cde8

    • SSDEEP

      6144:YpR42sUGyvBtBhVGIzgA2ssMenKFFW8fJTD45j+gmhy+mvVi+/G:stBttysVekQoZJgmhMYJ

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks