Overview

overview

10

Static

static

3

a0c31c2004...18.exe

windows7-x64

10

a0c31c2004...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0c31c2004e772b9dc420c24e06b5ea0_JaffaCakes118

  • Size

    556KB

  • Sample

    240612-p9xxyszaqp

  • MD5

    a0c31c2004e772b9dc420c24e06b5ea0

  • SHA1

    117cca1852b4cd263560892596778f23b59273b0

  • SHA256

    ba89fccf00aff3700c8cf86e4860dff92db2e15ae793e1a9db8e6b3dc45d5b3a

  • SHA512

    a14b57383516adcdb81f0fef12f4b6e98b3d548ca14f949d74039f33a7f03feab643478c6a3b3c5d22f25d75b5417705f9f3ef3c6288a41d72001efabc177285

  • SSDEEP

    12288:PbFmNHloUQYbEZpakjYDJA1zpYDwUei8jPjMQ:gHNQYbuDj6SfLjPb

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

190.12.119.180:443

47.50.251.130:80

107.2.2.28:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

186.75.241.230:80

59.103.164.174:80

209.97.168.52:8080

31.12.67.62:7080

206.189.112.148:8080

83.136.245.190:8080

189.209.217.49:80

87.230.19.21:8080

190.53.135.159:21

120.150.246.241:80

91.205.215.66:8080

128.65.154.183:443

104.236.246.93:8080
rsa_pubkey.plain

Targets

    • Target

      a0c31c2004e772b9dc420c24e06b5ea0_JaffaCakes118

    • Size

      556KB

    • MD5

      a0c31c2004e772b9dc420c24e06b5ea0

    • SHA1

      117cca1852b4cd263560892596778f23b59273b0

    • SHA256

      ba89fccf00aff3700c8cf86e4860dff92db2e15ae793e1a9db8e6b3dc45d5b3a

    • SHA512

      a14b57383516adcdb81f0fef12f4b6e98b3d548ca14f949d74039f33a7f03feab643478c6a3b3c5d22f25d75b5417705f9f3ef3c6288a41d72001efabc177285

    • SSDEEP

      12288:PbFmNHloUQYbEZpakjYDJA1zpYDwUei8jPjMQ:gHNQYbuDj6SfLjPb

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks