Overview

overview

10

Static

static

10

3444b2a35b...18.exe

windows7-x64

10

3444b2a35b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3444b2a35b74fb06edead1cffd4d7fd9_JaffaCakes118
  • Size 70KB
  • Sample240511-m6dnssde3v
  • SHA256 b78dd25ad989de2ae380ac8e42509cd2aa2c4e662e0c8c3fb488a9a20d3c537d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
epoch2emotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 179.12.170.88:8080

  • 182.76.6.2:8080

  • 201.250.11.236:50000

  • 86.98.25.30:53

  • 190.226.44.20:21

  • 198.199.88.162:8080

  • 178.62.37.188:443

  • 92.51.129.249:4143

  • 92.222.125.16:7080

  • 142.44.162.209:8080

  • 92.222.216.44:8080

  • 138.201.140.110:8080

  • 64.13.225.150:8080

  • 186.4.194.153:993

  • 182.176.132.213:8090

  • 37.157.194.134:443

  • 206.189.98.125:8080

  • 45.123.3.54:443

  • 45.33.49.124:443

  • 178.79.161.166:443

rsa_pubkey.plain

Signatures

  • Emotet family
    emotet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 3444b2a35b74fb06edead1cffd4d7fd9_JaffaCakes118
    .exe 70KB

3444b2a35b74fb06edead1cffd4d7fd9_JaffaCakes118

  • IMPHASH 009889c73bd2e55113bf6dfa5f395e0d
  • SHA256 b78dd25ad989de2ae380ac8e42509cd2aa2c4e662e0c8c3fb488a9a20d3c537d
  • MD5 SHA1 SHA512 SSDEEP
windows:6windowsx86arch:x86

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
61554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths