Overview

overview

10

Static

static

3

63a1727d61...18.exe

windows7-x64

10

63a1727d61...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63a1727d613477a831b67f35d1d91bfe_JaffaCakes118

  • Size

    640KB

  • Sample

    240729-145ldsxfmh

  • MD5

    63a1727d613477a831b67f35d1d91bfe

  • SHA1

    f0690328a9d5b17a3af83abd3b123791c11fc8ef

  • SHA256

    27ea180f7a8b2edfa1efd145d7e9fdf4bcf9cbb2d6914aedd1767dac63844674

  • SHA512

    d1463309fe743ab6ffa835fced6b87f492441db4aeb2e1f4b45965b04ff51812bb238b5690dfef2de888174f76f7a09b90b5dabe4e8daa48cac7bac105e21bb2

  • SSDEEP

    6144:aZ8LXFyqywQQCaKFh2gf8DVC0Vm8rFqUBscFH85fqtN/Hjfm/CXK6TiRWBYUT/O:aZ8uQCaGhSDTk8rF/BFJNfkn4iRki

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

82.225.49.121:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

203.117.253.142:80

139.99.158.11:443

87.106.139.101:8080

190.160.53.126:80

5.39.91.110:7080

107.5.122.110:80

174.102.48.180:443

194.187.133.160:443

153.177.101.120:443

104.236.246.93:8080

78.24.219.147:8080

94.23.237.171:443

85.66.181.138:80

157.245.99.39:8080

201.173.217.124:443

91.211.88.52:7080
rsa_pubkey.plain

Targets

    • Target

      63a1727d613477a831b67f35d1d91bfe_JaffaCakes118

    • Size

      640KB

    • MD5

      63a1727d613477a831b67f35d1d91bfe

    • SHA1

      f0690328a9d5b17a3af83abd3b123791c11fc8ef

    • SHA256

      27ea180f7a8b2edfa1efd145d7e9fdf4bcf9cbb2d6914aedd1767dac63844674

    • SHA512

      d1463309fe743ab6ffa835fced6b87f492441db4aeb2e1f4b45965b04ff51812bb238b5690dfef2de888174f76f7a09b90b5dabe4e8daa48cac7bac105e21bb2

    • SSDEEP

      6144:aZ8LXFyqywQQCaKFh2gf8DVC0Vm8rFqUBscFH85fqtN/Hjfm/CXK6TiRWBYUT/O:aZ8uQCaGhSDTk8rF/BFJNfkn4iRki

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks