Overview

overview

10

Static

static

3

bbf176feab...18.exe

windows7-x64

10

bbf176feab...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118
  • Size 448KB
  • Sample240618-pp6pcstcmg
  • SHA256 2a2fcbc4dba7678968198e402b7832d0b7beb8e98e1cb052ba89e9786d2726a7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 75.139.38.211:80

  • 69.30.203.214:8080

  • 67.205.85.243:8080

  • 190.160.53.126:80

  • 183.101.175.193:80

  • 137.59.187.107:8080

  • 168.235.67.138:7080

  • 209.143.35.232:80

  • 180.92.239.110:8080

  • 167.86.90.214:8080

  • 85.66.181.138:80

  • 95.213.236.64:8080

  • 83.169.36.251:8080

  • 157.245.99.39:8080

  • 79.98.24.39:8080

  • 70.167.215.250:8080

  • 93.51.50.171:8080

  • 174.102.48.180:80

  • 24.179.13.119:80

  • 41.60.200.34:80

rsa_pubkey.plain

Targets

    • Target
      bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118
    • Size 448KB
    • SHA256 2a2fcbc4dba7678968198e402b7832d0b7beb8e98e1cb052ba89e9786d2726a7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks