Overview

overview

10

Static

static

3

c8122ac758...18.exe

windows7-x64

10

c8122ac758...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8122ac758c632055d8017870b951c46_JaffaCakes118

  • Size

    696KB

  • Sample

    240829-cxsq9a1dmm

  • MD5

    c8122ac758c632055d8017870b951c46

  • SHA1

    78b411b5b96ce9de40519ffc36d6d778dc39ead5

  • SHA256

    67766b22aa574c3c7efa1256b4ebfe74a63040cfd7aba6759296600aa69a69ac

  • SHA512

    34e4778157ebff615d6b380ec12648107de29c300cb8343df57bf77c46ce53188d06b1029b075796cdb2cd901014eab261dc2cb748928e445f38840c902d9e4c

  • SSDEEP

    12288:AMzCEh70HZRYuqmQiLPa3LVJgmhMYU31:rhXgH

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

148.72.151.34:8080

37.187.2.199:443

173.249.47.77:8080

62.75.187.192:8080

181.143.194.138:443

133.167.80.63:7080

182.176.132.213:8090

37.157.194.134:443

152.89.236.214:8080

86.98.25.30:53

144.139.247.220:80

47.41.213.2:22

31.12.67.62:7080

83.136.245.190:8080

87.106.136.232:8080

178.210.51.222:8080

92.222.216.44:8080

159.65.25.128:8080

94.177.216.217:8080

182.76.6.2:8080
rsa_pubkey.plain

Targets

    • Target

      c8122ac758c632055d8017870b951c46_JaffaCakes118

    • Size

      696KB

    • MD5

      c8122ac758c632055d8017870b951c46

    • SHA1

      78b411b5b96ce9de40519ffc36d6d778dc39ead5

    • SHA256

      67766b22aa574c3c7efa1256b4ebfe74a63040cfd7aba6759296600aa69a69ac

    • SHA512

      34e4778157ebff615d6b380ec12648107de29c300cb8343df57bf77c46ce53188d06b1029b075796cdb2cd901014eab261dc2cb748928e445f38840c902d9e4c

    • SSDEEP

      12288:AMzCEh70HZRYuqmQiLPa3LVJgmhMYU31:rhXgH

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks