Overview

overview

10

Static

static

3

5310e05568...18.exe

windows7-x64

10

5310e05568...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5310e0556834e80ef9eb0bcf278852f5_JaffaCakes118
  • Size 392KB
  • Sample240518-e9jefscb7x
  • SHA256 5088f9fc000f8c162c58cf6e6c8c2440db33697d1b5edb8da49d6e9e56e50d2e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 50.63.13.135:8080

  • 80.211.32.88:8080

  • 222.239.249.166:443

  • 54.38.94.197:8080

  • 78.46.87.133:8080

  • 191.100.24.201:50000

  • 200.71.112.158:53

  • 212.129.14.27:8080

  • 190.189.79.73:80

  • 176.58.93.123:80

  • 113.52.135.33:7080

  • 161.18.233.114:80

  • 46.17.6.116:8080

  • 192.241.220.183:8080

  • 162.144.46.90:8080

  • 95.216.207.86:7080

  • 95.216.212.157:8080

  • 217.26.163.82:7080

  • 50.116.78.109:8080

  • 142.93.87.198:8080

rsa_pubkey.plain

Targets

    • Target
      5310e0556834e80ef9eb0bcf278852f5_JaffaCakes118
    • Size 392KB
    • SHA256 5088f9fc000f8c162c58cf6e6c8c2440db33697d1b5edb8da49d6e9e56e50d2e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks