Overview

overview

10

Static

static

3

18d65baea8...18.exe

windows7-x64

10

18d65baea8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d65baea8dfbee9c34c7d9b762b10b7_JaffaCakes118

  • Size

    212KB

  • Sample

    240505-w8n2zscg22

  • MD5

    18d65baea8dfbee9c34c7d9b762b10b7

  • SHA1

    e60495220d4000c6caa04be25822b80d4bfc2297

  • SHA256

    ca149717d43d2a113c894b33be843a0a0e26c1364c06d933f76c4b062b750f51

  • SHA512

    9c48e2b90f7f5318c9738ffa24e63e38d4b3a42c3ebb4c8fcd1ff4234c16419aefbcbdfe78c443047b883d55342009b2e0deb104534957cbed84e31d49bfbfb7

  • SSDEEP

    3072:FizbxqLRv2ZCvA1y1t3QoqVePUQGTbgYh/XsLlCP2wc:FOq55o10JQpeJGT8Yh/X8lS2z

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.229.155.122:80

5.88.182.250:80

128.65.154.183:443

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

211.63.71.72:8080

171.101.153.86:990

95.128.43.213:8080

31.172.240.91:8080

167.99.105.223:7080

24.45.193.161:7080

104.131.11.150:8080

167.71.10.37:8080

104.131.44.150:8080

190.108.228.48:990

195.244.215.206:80

192.241.220.155:8080

209.97.168.52:8080
rsa_pubkey.plain

Targets

    • Target

      18d65baea8dfbee9c34c7d9b762b10b7_JaffaCakes118

    • Size

      212KB

    • MD5

      18d65baea8dfbee9c34c7d9b762b10b7

    • SHA1

      e60495220d4000c6caa04be25822b80d4bfc2297

    • SHA256

      ca149717d43d2a113c894b33be843a0a0e26c1364c06d933f76c4b062b750f51

    • SHA512

      9c48e2b90f7f5318c9738ffa24e63e38d4b3a42c3ebb4c8fcd1ff4234c16419aefbcbdfe78c443047b883d55342009b2e0deb104534957cbed84e31d49bfbfb7

    • SSDEEP

      3072:FizbxqLRv2ZCvA1y1t3QoqVePUQGTbgYh/XsLlCP2wc:FOq55o10JQpeJGT8Yh/X8lS2z

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks