Overview

overview

10

Static

static

3

672e7bfd74...18.exe

windows7-x64

10

672e7bfd74...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118

  • Size

    600KB

  • Sample

    240522-n379nsfe5v

  • MD5

    672e7bfd74c6bfcae7a45b3eef091a89

  • SHA1

    f15a1f1265fa4b2f73620cf4b1c0fbe68756a94f

  • SHA256

    d0ce7284573bd0b16c06d34bdfcd6c1960738c0e8e39a6327c178523ce412f44

  • SHA512

    ef6551a467da3e1b0d122cb393ce6bad21c25c88507585d0671ec5fde1d0f306317a3c59bde617f11c24c594da1f505ad31fc167ef79403c9c333e77ae8552e6

  • SSDEEP

    12288:wmjIjUK9OJBC+DHRny6vi98eiSdaQCDQM0mnLpMoMwTkf:HnTp96da0MxpM5f

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

201.184.105.242:443

24.45.195.162:7080

24.45.195.162:8443

94.192.225.46:80

80.11.163.139:443

133.167.80.63:7080

198.199.114.69:8080

80.79.23.144:443

192.254.173.31:8080

67.225.229.55:8080

190.108.228.48:990

62.75.187.192:8080

185.94.252.13:443

94.205.247.10:80

211.63.71.72:8080

59.103.164.174:80

192.81.213.192:8080

27.4.80.183:443

190.145.67.134:8090

115.78.95.230:443
rsa_pubkey.plain

Targets

    • Target

      672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118

    • Size

      600KB

    • MD5

      672e7bfd74c6bfcae7a45b3eef091a89

    • SHA1

      f15a1f1265fa4b2f73620cf4b1c0fbe68756a94f

    • SHA256

      d0ce7284573bd0b16c06d34bdfcd6c1960738c0e8e39a6327c178523ce412f44

    • SHA512

      ef6551a467da3e1b0d122cb393ce6bad21c25c88507585d0671ec5fde1d0f306317a3c59bde617f11c24c594da1f505ad31fc167ef79403c9c333e77ae8552e6

    • SSDEEP

      12288:wmjIjUK9OJBC+DHRny6vi98eiSdaQCDQM0mnLpMoMwTkf:HnTp96da0MxpM5f

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks