Overview

overview

10

Static

static

10

64c33e1dec...18.exe

windows7-x64

10

64c33e1dec...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118

  • Size

    65KB

  • Sample

    240521-zv99vaad55

  • MD5

    64c33e1dec876047d0ad5388b2b3f68c

  • SHA1

    9042eda5afe90e9ad5427f9902fa1b52636f97a3

  • SHA256

    f2b14556fb5c28adebd021802236b7b94ca1c1d5ab9fcb3a802a5d6404644428

  • SHA512

    8c75104f4951786b93252bb13c21c8d75c0f25ecd46455b789fcce78c2dc40b45b400bcd9e8c5e965a206984e3c4bda4725dd1dd83464d0b3c5012ca3cf28291

  • SSDEEP

    1536:FE1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+qzL:2LjsXANkR/fkfdWolI9AiDrzL

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

186.159.246.121:80

201.210.70.8:8080

46.105.131.68:8080

192.163.221.191:8080

124.150.175.133:80

5.189.148.98:8080

95.216.207.86:7080

189.145.6.189:80

212.112.113.235:80

187.143.219.242:8080

189.132.130.111:8080

190.96.118.15:443

190.217.1.149:80

172.104.70.207:8080

42.190.4.92:443

152.170.220.95:80

203.99.188.11:443

216.75.37.196:8080

190.55.39.215:80

185.45.24.254:7080
rsa_pubkey.plain

Targets

    • Target

      64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118

    • Size

      65KB

    • MD5

      64c33e1dec876047d0ad5388b2b3f68c

    • SHA1

      9042eda5afe90e9ad5427f9902fa1b52636f97a3

    • SHA256

      f2b14556fb5c28adebd021802236b7b94ca1c1d5ab9fcb3a802a5d6404644428

    • SHA512

      8c75104f4951786b93252bb13c21c8d75c0f25ecd46455b789fcce78c2dc40b45b400bcd9e8c5e965a206984e3c4bda4725dd1dd83464d0b3c5012ca3cf28291

    • SSDEEP

      1536:FE1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+qzL:2LjsXANkR/fkfdWolI9AiDrzL

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks