Overview

overview

10

Static

static

3

64d9acbff6...18.exe

windows7-x64

10

64d9acbff6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64d9acbff6273f7442edac49f9eec054_JaffaCakes118

  • Size

    228KB

  • Sample

    240521-1g81asbc58

  • MD5

    64d9acbff6273f7442edac49f9eec054

  • SHA1

    7694e133c4f47a597544a8419c4ce88218841d72

  • SHA256

    7271b9b7dbcd1b2b17f7662d65b2fec44cfb378ef43fd8a03fccd7fb463fbe87

  • SHA512

    55797d8012613e282f6630d931d47572c24680fc70144e98d662f14a5a772eb73b46acb5badd567b8cb1866b8f6101575fd8a3d9301bb495897319091fd3c2c6

  • SSDEEP

    6144:kyj2MoeAfMzd+PUnXmCcWGJPV0z+bbDH0COUj8:1joeAfMVQP5bbbY

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

45.33.54.74:443

209.141.41.136:8080

104.236.246.93:8080

198.199.114.69:8080

152.89.236.214:8080

87.106.136.232:8080

178.210.51.222:8080

115.78.95.230:443

201.251.43.69:8080

200.51.94.251:80

31.172.240.91:8080

182.176.132.213:8090

45.33.49.124:443

181.143.53.227:21

186.4.172.5:443

85.104.59.244:20

5.196.74.210:8080

37.157.194.134:443

190.226.44.20:21

86.98.25.30:53
rsa_pubkey.plain

Targets

    • Target

      64d9acbff6273f7442edac49f9eec054_JaffaCakes118

    • Size

      228KB

    • MD5

      64d9acbff6273f7442edac49f9eec054

    • SHA1

      7694e133c4f47a597544a8419c4ce88218841d72

    • SHA256

      7271b9b7dbcd1b2b17f7662d65b2fec44cfb378ef43fd8a03fccd7fb463fbe87

    • SHA512

      55797d8012613e282f6630d931d47572c24680fc70144e98d662f14a5a772eb73b46acb5badd567b8cb1866b8f6101575fd8a3d9301bb495897319091fd3c2c6

    • SSDEEP

      6144:kyj2MoeAfMzd+PUnXmCcWGJPV0z+bbDH0COUj8:1joeAfMVQP5bbbY

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks