Overview

overview

10

Static

static

3

c01446e44a...18.exe

windows7-x64

10

c01446e44a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c01446e44adf3baa7e65008efaaee116_JaffaCakes118

  • Size

    504KB

  • Sample

    240825-ggz8lsxgpe

  • MD5

    c01446e44adf3baa7e65008efaaee116

  • SHA1

    aeda7ff3c85b7d6fe1e2c0fa5af949b93c52a6c9

  • SHA256

    3ae6a4c47db8a44af02dcfd405405b9c9f10a0ee32af7bf4f602535f2d1424b2

  • SHA512

    d3bce5aa3eecc0a9d3b82c5423ee6787374f2766c362ef43ab81d78cb338cae2aff3c764942e1fa1e9f238323ab34025c24a080c5f09651da31e8c6dc718672e

  • SSDEEP

    12288:tYUfuKq21VoikY0P56pQW1iUfwfuS4URn:thuKq21lkY0PgpQ8iSUuSzn

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.91.208.86:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

107.5.122.110:80

103.86.49.11:8080

85.105.205.77:8080

120.150.60.189:80

137.59.187.107:8080

139.59.60.244:8080

203.117.253.142:80

1.221.254.82:80

97.82.79.83:80

37.187.72.193:8080

139.99.158.11:443

152.168.248.128:443

74.208.45.104:8080

83.169.36.251:8080

169.239.182.217:8080

216.208.76.186:80
rsa_pubkey.plain

Targets

    • Target

      c01446e44adf3baa7e65008efaaee116_JaffaCakes118

    • Size

      504KB

    • MD5

      c01446e44adf3baa7e65008efaaee116

    • SHA1

      aeda7ff3c85b7d6fe1e2c0fa5af949b93c52a6c9

    • SHA256

      3ae6a4c47db8a44af02dcfd405405b9c9f10a0ee32af7bf4f602535f2d1424b2

    • SHA512

      d3bce5aa3eecc0a9d3b82c5423ee6787374f2766c362ef43ab81d78cb338cae2aff3c764942e1fa1e9f238323ab34025c24a080c5f09651da31e8c6dc718672e

    • SSDEEP

      12288:tYUfuKq21VoikY0P56pQW1iUfwfuS4URn:thuKq21lkY0PgpQ8iSUuSzn

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks