Overview

overview

10

Static

static

3

6a65c3a66c...18.exe

windows7-x64

10

6a65c3a66c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118

  • Size

    320KB

  • Sample

    240523-ksmcnsbc74

  • MD5

    6a65c3a66cc3168ae6187ea6a1ab5d43

  • SHA1

    a4abe68aec6ff1ec1a5e31551284c9365fbc0bbe

  • SHA256

    4f03705e248f307c693af5a0a560d435c0590144c280e7df962d97adbf0d6416

  • SHA512

    5b81d8f324ecf89357d6b6863d5b1aa79ee2cc1ca14329e8e71a1a9137cc447652e29c904da0e024ff554df1cc91f2ac8e26ada304a2d68d026ac15964f1ea85

  • SSDEEP

    6144:FmsuMp/+Nu3Q6e73qE9TMp5pQPNbwLzJWj:FZfpaube7vTC5aGWj

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

172.104.233.225:8080

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

87.106.77.40:7080

77.55.211.77:8080

201.190.133.235:8080

181.16.17.210:443

87.118.70.69:8080

45.79.95.107:443

111.119.233.65:80

138.68.106.4:7080

200.113.106.18:80

170.130.31.177:8080

91.83.93.124:7080

212.71.237.140:8080

76.69.29.42:80

50.28.51.143:8080

68.183.190.199:8080

190.146.131.105:8080
rsa_pubkey.plain

Targets

    • Target

      6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118

    • Size

      320KB

    • MD5

      6a65c3a66cc3168ae6187ea6a1ab5d43

    • SHA1

      a4abe68aec6ff1ec1a5e31551284c9365fbc0bbe

    • SHA256

      4f03705e248f307c693af5a0a560d435c0590144c280e7df962d97adbf0d6416

    • SHA512

      5b81d8f324ecf89357d6b6863d5b1aa79ee2cc1ca14329e8e71a1a9137cc447652e29c904da0e024ff554df1cc91f2ac8e26ada304a2d68d026ac15964f1ea85

    • SSDEEP

      6144:FmsuMp/+Nu3Q6e73qE9TMp5pQPNbwLzJWj:FZfpaube7vTC5aGWj

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks