Overview

overview

10

Static

static

3

d2f93db8e2...18.exe

windows7-x64

10

d2f93db8e2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2f93db8e28bb1e5f637eac11c56ff6f_JaffaCakes118

  • Size

    244KB

  • Sample

    240907-2hfktaygnn

  • MD5

    d2f93db8e28bb1e5f637eac11c56ff6f

  • SHA1

    58de01afdf152ad29fbe5feade8de28b6557a2ba

  • SHA256

    1e82bd48d5bb736b94bf9b99cd0e686f662f33934e993e5dda8d604e052cffe0

  • SHA512

    4e9d387eb44c5e0f832aca212f790b11b3167299be4032ae4d7908406ca2f790660874710974e572e07f921e7985d2112dc3731fbe69f848b1997cb58f443b88

  • SSDEEP

    3072:yjQlpRi39Mm+sQ71RdOauo1GUVPEIEqLtH:y0lpRaMdJ1vOiPEc5H

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080
rsa_pubkey.plain

Targets

    • Target

      d2f93db8e28bb1e5f637eac11c56ff6f_JaffaCakes118

    • Size

      244KB

    • MD5

      d2f93db8e28bb1e5f637eac11c56ff6f

    • SHA1

      58de01afdf152ad29fbe5feade8de28b6557a2ba

    • SHA256

      1e82bd48d5bb736b94bf9b99cd0e686f662f33934e993e5dda8d604e052cffe0

    • SHA512

      4e9d387eb44c5e0f832aca212f790b11b3167299be4032ae4d7908406ca2f790660874710974e572e07f921e7985d2112dc3731fbe69f848b1997cb58f443b88

    • SSDEEP

      3072:yjQlpRi39Mm+sQ71RdOauo1GUVPEIEqLtH:y0lpRaMdJ1vOiPEc5H

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks