Overview

overview

10

Static

static

3

6d4100435e...18.exe

windows7-x64

10

6d4100435e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d4100435ea06df721101446308b4570_JaffaCakes118

  • Size

    364KB

  • Sample

    240524-eed69aca4y

  • MD5

    6d4100435ea06df721101446308b4570

  • SHA1

    3e64ed663205449eea018dc60c7f589acb6829ca

  • SHA256

    04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562

  • SHA512

    7cfc308a6a21165aac8bdce920f9472fa10fc4d83cdd3797be8089ab820031ce302bb48086120a36ff4fd12d231233ebfd7ffa044a812813bf18f812aaa524fd

  • SSDEEP

    6144:By2JRLj6K2gxsKRTVJO/W5TXfU4qHFDbTebas8PZRwBMj:BLJpj6UxTV8/+f0lLUS

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

54.38.94.197:8080

192.161.190.171:8080

80.93.48.49:7080

222.239.249.166:443

195.226.144.249:80

216.75.37.196:8080

192.163.221.191:8080

200.71.112.158:53

119.159.150.176:443

113.52.135.33:7080

50.116.78.109:8080

124.150.175.133:80

139.162.185.116:443

124.150.175.129:8080

157.7.164.178:8081

37.59.24.25:8080

51.38.134.203:8080

217.26.163.82:7080

172.104.70.207:8080

201.196.15.79:990
rsa_pubkey.plain

Targets

    • Target

      6d4100435ea06df721101446308b4570_JaffaCakes118

    • Size

      364KB

    • MD5

      6d4100435ea06df721101446308b4570

    • SHA1

      3e64ed663205449eea018dc60c7f589acb6829ca

    • SHA256

      04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562

    • SHA512

      7cfc308a6a21165aac8bdce920f9472fa10fc4d83cdd3797be8089ab820031ce302bb48086120a36ff4fd12d231233ebfd7ffa044a812813bf18f812aaa524fd

    • SSDEEP

      6144:By2JRLj6K2gxsKRTVJO/W5TXfU4qHFDbTebas8PZRwBMj:BLJpj6UxTV8/+f0lLUS

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks