Overview

overview

10

Static

static

3

5dacde026a...18.exe

windows7-x64

10

5dacde026a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dacde026aa823e67abec6dfceca998e_JaffaCakes118

  • Size

    364KB

  • Sample

    240520-heslesga79

  • MD5

    5dacde026aa823e67abec6dfceca998e

  • SHA1

    45d21979f5e596283786f52eefcf3b4961918ebd

  • SHA256

    4a8f2605e412da34ebf8f613d480d1ccce195f620a64087ef1eca992e3d4151c

  • SHA512

    dd9eb88cc10ba13fae6149c0c2ed99fc568a09e5497704057dc1ac56a1ef497123451e20b1365f50f0819f35a585391c80c13aaa2a067743d7304deb58756475

  • SSDEEP

    6144:+y2JRLj6K2gxsKRTVJO/W5TXfU4qHMjbTebas8PZ1wBM2:+LJpj6UxTV8/+f0KLYH

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

104.236.137.72:8080

172.104.233.225:8080

213.189.36.51:8080

85.234.143.94:8080

46.28.111.142:7080

186.1.41.111:443

181.36.42.205:443

149.62.173.247:8080

185.86.148.222:8080

190.38.14.52:80

200.113.106.18:80

181.198.203.45:443

190.102.226.91:80

201.163.74.202:443

96.20.84.254:7080

190.195.129.227:8090

189.173.113.67:443

190.97.30.167:990

183.82.97.25:80

80.85.87.122:8080
rsa_pubkey.plain

Targets

    • Target

      5dacde026aa823e67abec6dfceca998e_JaffaCakes118

    • Size

      364KB

    • MD5

      5dacde026aa823e67abec6dfceca998e

    • SHA1

      45d21979f5e596283786f52eefcf3b4961918ebd

    • SHA256

      4a8f2605e412da34ebf8f613d480d1ccce195f620a64087ef1eca992e3d4151c

    • SHA512

      dd9eb88cc10ba13fae6149c0c2ed99fc568a09e5497704057dc1ac56a1ef497123451e20b1365f50f0819f35a585391c80c13aaa2a067743d7304deb58756475

    • SSDEEP

      6144:+y2JRLj6K2gxsKRTVJO/W5TXfU4qHMjbTebas8PZ1wBM2:+LJpj6UxTV8/+f0KLYH

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks