Overview

overview

10

Static

static

3

6d4100435e...18.exe

windows7-x64

10

6d4100435e...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6d4100435ea06df721101446308b4570_JaffaCakes118
  • Size 364KB
  • Sample240524-eed69aca4y
  • SHA256 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 54.38.94.197:8080

  • 192.161.190.171:8080

  • 80.93.48.49:7080

  • 222.239.249.166:443

  • 195.226.144.249:80

  • 216.75.37.196:8080

  • 192.163.221.191:8080

  • 200.71.112.158:53

  • 119.159.150.176:443

  • 113.52.135.33:7080

  • 50.116.78.109:8080

  • 124.150.175.133:80

  • 139.162.185.116:443

  • 124.150.175.129:8080

  • 157.7.164.178:8081

  • 37.59.24.25:8080

  • 51.38.134.203:8080

  • 217.26.163.82:7080

  • 172.104.70.207:8080

  • 201.196.15.79:990

rsa_pubkey.plain

Targets

    • Target
      6d4100435ea06df721101446308b4570_JaffaCakes118
    • Size 364KB
    • SHA256 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks