Overview

overview

10

Static

static

3

d226ff9f8b...18.exe

windows7-x64

10

d226ff9f8b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d226ff9f8be818bea5cfef3007ce6c3e_JaffaCakes118

  • Size

    268KB

  • Sample

    240907-rty67ayckr

  • MD5

    d226ff9f8be818bea5cfef3007ce6c3e

  • SHA1

    94900c1b24b03f087206b78e99fde0b1ee9eaf0e

  • SHA256

    b66e5aebe38403fee593e1fe0d85513bfd688b926d762c618fce5864821f400c

  • SHA512

    89122d8d0a936fe073f074aed256a22a5e662ac31597936f4b257e55f28333f409b122583340fcbf94ef268cbdff64939038c9826c3ada4971e68a2b3a346858

  • SSDEEP

    3072:iJ64dCfmyfm89HofYh4Cdx3/mMHoed8X1OBeUgR6zEHYBhMrDNelZc/d:i0mSmcS+LP/yR1c4YkKK

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21
rsa_pubkey.plain

Targets

    • Target

      d226ff9f8be818bea5cfef3007ce6c3e_JaffaCakes118

    • Size

      268KB

    • MD5

      d226ff9f8be818bea5cfef3007ce6c3e

    • SHA1

      94900c1b24b03f087206b78e99fde0b1ee9eaf0e

    • SHA256

      b66e5aebe38403fee593e1fe0d85513bfd688b926d762c618fce5864821f400c

    • SHA512

      89122d8d0a936fe073f074aed256a22a5e662ac31597936f4b257e55f28333f409b122583340fcbf94ef268cbdff64939038c9826c3ada4971e68a2b3a346858

    • SSDEEP

      3072:iJ64dCfmyfm89HofYh4Cdx3/mMHoed8X1OBeUgR6zEHYBhMrDNelZc/d:i0mSmcS+LP/yR1c4YkKK

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks