Overview

overview

10

Static

static

3

6f0abe881c...18.exe

windows7-x64

10

6f0abe881c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f0abe881cbd900fcbd7417ccdc5efdd_JaffaCakes118

  • Size

    127KB

  • Sample

    240524-tax6wsbe38

  • MD5

    6f0abe881cbd900fcbd7417ccdc5efdd

  • SHA1

    153cdc8e0c4bb8779556be6808a1dbcc4c467d0e

  • SHA256

    1f8000d9e5ec11e16e8c6348e6ffc8f13c0f3d1f97c473cc192994dfa9a21c50

  • SHA512

    5b400b0568df97241379aae67416f532a2402b55c12d26b400fb842aba0fdce4f516d03340143025865614831b7533a670139a5ce7e1811ebb26e328303766d7

  • SSDEEP

    3072:S7ENeetJZZ6PdIzMda4wTz33otG+xyz2DgIeR1jKi8G:VBJZZGIz93z33ryy6DO

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

83.169.33.157:8080

222.239.249.166:443

217.26.163.82:7080

91.205.173.54:8080

5.189.148.98:8080

187.177.155.123:990

172.245.13.50:8080

193.34.144.138:8080

119.159.150.176:443

143.95.101.72:8080

191.100.24.201:50000

139.162.185.116:443

195.201.56.68:7080

23.253.207.142:8080

192.163.221.191:8080

162.144.46.90:8080

103.205.177.229:80

190.189.79.73:80

163.172.97.112:8080

138.197.140.163:8080
rsa_pubkey.plain

Targets

    • Target

      6f0abe881cbd900fcbd7417ccdc5efdd_JaffaCakes118

    • Size

      127KB

    • MD5

      6f0abe881cbd900fcbd7417ccdc5efdd

    • SHA1

      153cdc8e0c4bb8779556be6808a1dbcc4c467d0e

    • SHA256

      1f8000d9e5ec11e16e8c6348e6ffc8f13c0f3d1f97c473cc192994dfa9a21c50

    • SHA512

      5b400b0568df97241379aae67416f532a2402b55c12d26b400fb842aba0fdce4f516d03340143025865614831b7533a670139a5ce7e1811ebb26e328303766d7

    • SSDEEP

      3072:S7ENeetJZZ6PdIzMda4wTz33otG+xyz2DgIeR1jKi8G:VBJZZGIz93z33ryy6DO

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks