Overview

overview

10

Static

static

3

593f33b5ab...18.exe

windows7-x64

10

593f33b5ab...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118

  • Size

    267KB

  • Sample

    240519-jbxlmsgf3w

  • MD5

    593f33b5ab1a83bfdd8dc1b52c9b4709

  • SHA1

    3fbd1b61716acd1f5bc4e8efcf2e30626f58e6f3

  • SHA256

    5638332978984303342b0e7f6d86b6d2a0122c166c6184414b75a40c64b96990

  • SHA512

    c5a13ac20fb29c192061f72b52b6070f0e9e487b53f34aa7bb6ea673963dfb0d836c1211ce64654584acdad958a7380cf440e893dbcc3cda1815fb09566093d4

  • SSDEEP

    6144:RQTvKi6ThBpY+cerayRzcEXOi8oAqUkc0lHZ68GC:RKekkra47X0qUkc0cC

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

186.84.173.153:80

181.36.42.205:443

190.166.25.99:80

131.0.103.200:8080

78.46.103.90:7080

94.177.253.126:80

120.138.101.250:80

200.55.168.82:20

75.154.163.1:8090

95.216.207.86:7080

190.96.118.15:443

144.76.62.10:8080

212.112.113.235:80

184.82.233.15:80

157.7.164.178:8081

113.52.135.33:7080

176.58.93.123:80

51.38.134.203:8080

190.228.212.165:50000

203.99.188.11:443
rsa_pubkey.plain

Targets

    • Target

      593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118

    • Size

      267KB

    • MD5

      593f33b5ab1a83bfdd8dc1b52c9b4709

    • SHA1

      3fbd1b61716acd1f5bc4e8efcf2e30626f58e6f3

    • SHA256

      5638332978984303342b0e7f6d86b6d2a0122c166c6184414b75a40c64b96990

    • SHA512

      c5a13ac20fb29c192061f72b52b6070f0e9e487b53f34aa7bb6ea673963dfb0d836c1211ce64654584acdad958a7380cf440e893dbcc3cda1815fb09566093d4

    • SSDEEP

      6144:RQTvKi6ThBpY+cerayRzcEXOi8oAqUkc0lHZ68GC:RKekkra47X0qUkc0cC

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks