Overview

overview

10

Static

static

3

d1ba3b3cb0...18.exe

windows7-x64

10

d1ba3b3cb0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118

  • Size

    603KB

  • Sample

    240907-mkxvjszcpa

  • MD5

    d1ba3b3cb0e999eebe293e1b4f41e9aa

  • SHA1

    210a5c8d6421b8f924c94ea25fb890f0bae6d90e

  • SHA256

    9cdfee7919d8c8f6c5a6ec22dbeb7761b46530f1f0d6ae7f78c740b8ed45d927

  • SHA512

    7b522289022a7dc8299465fc123ac2542db7ddd17e95ab9f771982f6d9ca9519178b5e2c12ff031e103d910872d3eb47e7666e175285d26a10a52921140d2805

  • SSDEEP

    12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080
rsa_pubkey.plain

Targets

    • Target

      d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118

    • Size

      603KB

    • MD5

      d1ba3b3cb0e999eebe293e1b4f41e9aa

    • SHA1

      210a5c8d6421b8f924c94ea25fb890f0bae6d90e

    • SHA256

      9cdfee7919d8c8f6c5a6ec22dbeb7761b46530f1f0d6ae7f78c740b8ed45d927

    • SHA512

      7b522289022a7dc8299465fc123ac2542db7ddd17e95ab9f771982f6d9ca9519178b5e2c12ff031e103d910872d3eb47e7666e175285d26a10a52921140d2805

    • SSDEEP

      12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks