Overview

overview

10

Static

static

3

814fd7dd65...18.exe

windows7-x64

10

814fd7dd65...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    814fd7dd657a0c3fdbd63dd762634a6d_JaffaCakes118

  • Size

    138KB

  • Sample

    240801-vlpjkazgmp

  • MD5

    814fd7dd657a0c3fdbd63dd762634a6d

  • SHA1

    de67297a468a001d498d159f733ce0a2af09b47a

  • SHA256

    73076f6e3b3991be8b21d656e8447799b399c1991eef83d31a2c339994ed540b

  • SHA512

    63d668cf44e34f1637a11997b436fb000e4a5eef6cf0f2cd72077a03037bad865ab5819b2000bc38cb02bd356f4d8b0e5ed8dd588e77b865e6853be130db54c8

  • SSDEEP

    3072:iiUOvpJ/ogu1pMQWqNgL4xuEQsxqzdL1y2xknIk2d+:i3OvDowQWqi6LQd/y2xkH

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

67.10.155.92:80

38.111.46.46:8080

134.209.36.254:8080

162.241.242.173:8080

2.84.135.163:80

94.1.108.190:443

140.186.212.146:80

95.179.229.244:8080

200.114.213.233:8080

113.61.66.94:80

190.240.194.77:443

61.19.246.238:443

110.5.16.198:80

83.169.36.251:8080

37.187.72.193:8080

176.111.60.55:8080

85.105.205.77:8080

168.235.67.138:7080

200.123.150.89:443

87.106.139.101:8080
rsa_pubkey.plain

Targets

    • Target

      814fd7dd657a0c3fdbd63dd762634a6d_JaffaCakes118

    • Size

      138KB

    • MD5

      814fd7dd657a0c3fdbd63dd762634a6d

    • SHA1

      de67297a468a001d498d159f733ce0a2af09b47a

    • SHA256

      73076f6e3b3991be8b21d656e8447799b399c1991eef83d31a2c339994ed540b

    • SHA512

      63d668cf44e34f1637a11997b436fb000e4a5eef6cf0f2cd72077a03037bad865ab5819b2000bc38cb02bd356f4d8b0e5ed8dd588e77b865e6853be130db54c8

    • SSDEEP

      3072:iiUOvpJ/ogu1pMQWqNgL4xuEQsxqzdL1y2xknIk2d+:i3OvDowQWqi6LQd/y2xkH

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks