Overview

overview

10

Static

static

3

59eaa74dc0...18.exe

windows7-x64

10

59eaa74dc0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59eaa74dc01fe6c6c4abc346a4329cc4_JaffaCakes118

  • Size

    616KB

  • Sample

    240519-mevs1aea4z

  • MD5

    59eaa74dc01fe6c6c4abc346a4329cc4

  • SHA1

    1a221733c3bd129af88ee522f2be7e69dabbd577

  • SHA256

    c31ae55b6b4a2ade8e8cd8b421e733f26e4c690f9f4937ee7b538201467193aa

  • SHA512

    05020c4bea8b84ec4e1a8547901e042f84482e7690034d728842b759c86903c55584421df40f58970f455b1fba74ddfa087414fa9598dc4f2eda14adabff7e6c

  • SSDEEP

    6144:KNyMUE8JKsa4OQu+/Qj/3XonIgmOUPph8HPcSpoS482U7laNytEm:AypE8JhOQu+IzYnIUUG482p

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.186.191.177:80

91.242.138.5:80

173.13.135.102:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

80.11.163.139:21

182.176.132.213:8090

165.227.156.155:443

118.201.230.249:80

138.201.140.110:8080

46.105.131.87:80

87.106.139.101:8080

24.45.193.161:7080

209.97.168.52:8080

190.12.119.180:443

190.147.215.53:22

191.92.209.110:7080

91.205.215.66:8080
rsa_pubkey.plain

Targets

    • Target

      59eaa74dc01fe6c6c4abc346a4329cc4_JaffaCakes118

    • Size

      616KB

    • MD5

      59eaa74dc01fe6c6c4abc346a4329cc4

    • SHA1

      1a221733c3bd129af88ee522f2be7e69dabbd577

    • SHA256

      c31ae55b6b4a2ade8e8cd8b421e733f26e4c690f9f4937ee7b538201467193aa

    • SHA512

      05020c4bea8b84ec4e1a8547901e042f84482e7690034d728842b759c86903c55584421df40f58970f455b1fba74ddfa087414fa9598dc4f2eda14adabff7e6c

    • SSDEEP

      6144:KNyMUE8JKsa4OQu+/Qj/3XonIgmOUPph8HPcSpoS482U7laNytEm:AypE8JhOQu+IzYnIUUG482p

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks