Overview

overview

10

Static

static

3

4d7ef2a7ae...18.exe

windows7-x64

10

4d7ef2a7ae...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    4d7ef2a7aeb9b35edc5258c74ad0f7d5_JaffaCakes118
  • Size 367KB
  • Sample240516-27rdlsdf74
  • SHA256 40d37fd4c14457aee5abb8dc6de4c965a11a02d49b9bfda693d2a9d602a0e1f9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 105.226.188.128:8090

  • 91.205.173.54:8080

  • 163.172.97.112:8080

  • 72.47.202.235:8080

  • 46.17.6.116:8080

  • 46.105.131.68:8080

  • 37.59.24.25:8080

  • 152.169.32.143:8080

  • 178.249.187.150:7080

  • 23.253.207.142:8080

  • 201.196.15.79:990

  • 187.177.155.123:990

  • 189.154.130.167:443

  • 176.58.93.123:80

  • 191.100.24.201:50000

  • 192.163.221.191:8080

  • 190.128.222.14:80

  • 51.38.134.203:8080

  • 157.7.164.178:8081

  • 95.216.212.157:8080

rsa_pubkey.plain

Targets

    • Target
      4d7ef2a7aeb9b35edc5258c74ad0f7d5_JaffaCakes118
    • Size 367KB
    • SHA256 40d37fd4c14457aee5abb8dc6de4c965a11a02d49b9bfda693d2a9d602a0e1f9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks