Overview

overview

10

Static

static

3

56a74a8908...18.exe

windows7-x64

10

56a74a8908...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56a74a8908b0828cfbe2fc3fe31370b5_JaffaCakes118

  • Size

    150KB

  • Sample

    240518-zcep8aeg39

  • MD5

    56a74a8908b0828cfbe2fc3fe31370b5

  • SHA1

    c3406c91d8ac0c51b8c355eaffe78b5c631e2f23

  • SHA256

    df159e1c84b06cf4634f46a45f88bcce5b42eda62066d5281f0102d75e69c83f

  • SHA512

    8b22efe067e1479e53573e2ed62cf047877e78e11b7a3dcfb5fd7713da45672c6694971adc9859d008abc9d55d15ac721b2d95df6524a0234e99783d38005ebc

  • SSDEEP

    3072:UxncMgH2URcG0yBaoqBuBhh6U74AZeH4vwt1UgCojoo:Ulc7H2U2iaoqBihh175FSUgCojoo

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

189.173.113.67:443

200.123.101.90:80

170.130.31.177:8080

51.255.165.160:8080

45.56.79.249:443

185.86.148.222:8080

190.4.50.26:80

187.188.166.192:80

94.177.183.28:8080

201.213.32.59:80

76.69.29.42:80

190.96.118.15:443

81.213.215.216:50000

80.85.87.122:8080

186.1.41.111:443

183.82.97.25:80

220.241.38.226:50000

14.160.93.230:80

200.58.83.179:80

138.68.106.4:7080
rsa_pubkey.plain

Targets

    • Target

      56a74a8908b0828cfbe2fc3fe31370b5_JaffaCakes118

    • Size

      150KB

    • MD5

      56a74a8908b0828cfbe2fc3fe31370b5

    • SHA1

      c3406c91d8ac0c51b8c355eaffe78b5c631e2f23

    • SHA256

      df159e1c84b06cf4634f46a45f88bcce5b42eda62066d5281f0102d75e69c83f

    • SHA512

      8b22efe067e1479e53573e2ed62cf047877e78e11b7a3dcfb5fd7713da45672c6694971adc9859d008abc9d55d15ac721b2d95df6524a0234e99783d38005ebc

    • SSDEEP

      3072:UxncMgH2URcG0yBaoqBuBhh6U74AZeH4vwt1UgCojoo:Ulc7H2U2iaoqBihh175FSUgCojoo

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks