Overview

overview

10

Static

static

3

57531b3474...18.exe

windows7-x64

10

57531b3474...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57531b347491ca0eb1c28d644590acfa_JaffaCakes118

  • Size

    323KB

  • Sample

    240718-pcm2gs1dlg

  • MD5

    57531b347491ca0eb1c28d644590acfa

  • SHA1

    d093e2e7f5a048b5c58abb212b394f294979fb4d

  • SHA256

    33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930

  • SHA512

    4b9c2f5f6ddea17b1c6e1686a3a54279e11bb37eecab561646d919bccd00ebd17bb43d7165a24b6fde645c76242d6c23f0f462c0e7a60d0abe468c9a9f834db3

  • SSDEEP

    6144:AvGO3yl828vcPv2yv8vrvvvLvvvLvvvrvvvLvvvrvjvrvTPnbH7fvTv1KkOOU0qy:Q1y6Kl05

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.105.11.15:8080

91.121.116.137:443

80.79.23.144:443

138.201.140.110:8080

95.128.43.213:8080

190.228.72.244:53

185.94.252.13:443

37.157.194.134:443

45.79.188.67:8080

27.4.80.183:443

80.11.163.139:443

152.89.236.214:8080

62.75.187.192:8080

189.209.217.49:80

190.106.97.230:443

222.214.218.192:8080

63.142.253.122:8080

206.189.98.125:8080

181.31.213.158:8080

78.24.219.147:8080
rsa_pubkey.plain

Targets

    • Target

      57531b347491ca0eb1c28d644590acfa_JaffaCakes118

    • Size

      323KB

    • MD5

      57531b347491ca0eb1c28d644590acfa

    • SHA1

      d093e2e7f5a048b5c58abb212b394f294979fb4d

    • SHA256

      33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930

    • SHA512

      4b9c2f5f6ddea17b1c6e1686a3a54279e11bb37eecab561646d919bccd00ebd17bb43d7165a24b6fde645c76242d6c23f0f462c0e7a60d0abe468c9a9f834db3

    • SSDEEP

      6144:AvGO3yl828vcPv2yv8vrvvvLvvvLvvvrvvvLvvvrvjvrvTPnbH7fvTv1KkOOU0qy:Q1y6Kl05

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks