Overview

overview

10

Static

static

3

ceeb492122...18.exe

windows7-x64

10

ceeb492122...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ceeb49212258592237a36abef80cb067_JaffaCakes118

  • Size

    768KB

  • Sample

    240906-hj84zasanp

  • MD5

    ceeb49212258592237a36abef80cb067

  • SHA1

    3c3edf68db5f9b256e8065984c1ac2022e247b41

  • SHA256

    e70c03550b4f1b5635f72bfa0d4129fea4a0c2a7af2d877d27444518bb22406e

  • SHA512

    09716338487e9290b7fe3d31c0d977b0832d29e9a842c2f9926bebabc4454bd0e658ff7b424482bc07a220d8d6c78b921b5b290174ebce1037fbb57011160825

  • SSDEEP

    12288:vVoOoSoPDHN7fy5YR9y1f+89zltrqgYCcy+:vaoHl+8dltrqccJ

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.188.166.192:80

42.190.4.92:443

170.130.31.177:8080

51.255.165.160:8080

45.56.79.249:443

60.52.64.122:80

190.182.161.7:8080

86.42.166.147:80

91.83.93.124:7080

186.1.41.111:443

51.15.8.192:8080

104.131.58.132:8080

142.93.114.137:8080

201.213.32.59:80

163.172.40.218:7080

190.230.60.129:80

87.106.77.40:7080

190.230.60.129:8080

190.79.228.89:443

178.249.187.151:8080
rsa_pubkey.plain

Targets

    • Target

      ceeb49212258592237a36abef80cb067_JaffaCakes118

    • Size

      768KB

    • MD5

      ceeb49212258592237a36abef80cb067

    • SHA1

      3c3edf68db5f9b256e8065984c1ac2022e247b41

    • SHA256

      e70c03550b4f1b5635f72bfa0d4129fea4a0c2a7af2d877d27444518bb22406e

    • SHA512

      09716338487e9290b7fe3d31c0d977b0832d29e9a842c2f9926bebabc4454bd0e658ff7b424482bc07a220d8d6c78b921b5b290174ebce1037fbb57011160825

    • SSDEEP

      12288:vVoOoSoPDHN7fy5YR9y1f+89zltrqgYCcy+:vaoHl+8dltrqccJ

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks