Overview

overview

10

Static

static

3

0f1bad2917...18.exe

windows7-x64

10

0f1bad2917...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0f1bad291775ba17f954bf5d46a66378_JaffaCakes118
  • Size 660KB
  • Sample240625-w7tk3sycml
  • SHA256 ea5c2320f12468ea939473e037f53e4e14a674820f36b3e86e9afa58bf63efef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 186.1.41.111:443

  • 189.136.50.227:443

  • 80.240.141.141:7080

  • 185.187.198.10:8080

  • 178.249.187.151:8080

  • 185.86.148.222:8080

  • 187.199.158.226:7080

  • 212.71.237.140:8080

  • 91.83.93.124:7080

  • 190.230.60.129:80

  • 123.168.4.66:22

  • 77.55.211.77:8080

  • 139.5.237.27:443

  • 50.28.51.143:8080

  • 189.166.68.89:443

  • 88.250.223.190:8080

  • 81.169.140.14:443

  • 187.188.166.192:80

  • 46.163.144.228:80

  • 181.36.42.205:443

rsa_pubkey.plain

Targets

    • Target
      0f1bad291775ba17f954bf5d46a66378_JaffaCakes118
    • Size 660KB
    • SHA256 ea5c2320f12468ea939473e037f53e4e14a674820f36b3e86e9afa58bf63efef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks