Overview

overview

10

Static

static

3

09df7954cd...18.exe

windows7-x64

10

09df7954cd...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    09df7954cd926a36a5736bb215c058d4_JaffaCakes118
  • Size 660KB
  • Sample240624-v5fe1athlf
  • SHA256 ed4532a4cfca2d06f30c964adfbcc6fc0215b3720caaa8f08919fff25103aa7d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 203.99.182.135:443

  • 181.97.70.132:8080

  • 115.88.70.226:7080

  • 203.150.19.63:443

  • 216.154.222.52:7080

  • 190.55.86.138:8443

  • 125.99.61.162:7080

  • 83.169.33.157:8080

  • 197.211.244.6:443

  • 80.227.67.18:20

  • 176.58.93.123:80

  • 201.244.125.210:995

  • 186.93.167.147:443

  • 190.96.118.15:443

  • 41.60.202.26:22

  • 139.59.242.76:8080

  • 190.117.206.153:443

  • 152.170.220.95:80

  • 113.52.135.33:7080

  • 181.113.229.139:990

rsa_pubkey.plain

Targets

    • Target
      09df7954cd926a36a5736bb215c058d4_JaffaCakes118
    • Size 660KB
    • SHA256 ed4532a4cfca2d06f30c964adfbcc6fc0215b3720caaa8f08919fff25103aa7d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks