Overview

overview

10

Static

static

3

daf83e264f...18.exe

windows7-x64

10

daf83e264f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daf83e264f87da2a0801d101c8046de6_JaffaCakes118

  • Size

    272KB

  • Sample

    240911-w4m9wswekd

  • MD5

    daf83e264f87da2a0801d101c8046de6

  • SHA1

    1a5d2346d1574de64378fdc382c8383e2cd89925

  • SHA256

    58c50898d344b65dea04f9577c9810e07544754ae24c81230310422288fa6cae

  • SHA512

    6f3b4e7ed8ccd77914b6f8745541434b1c5f32c7e6531d8fce238ce2b27e38305f524db1b318ff49616578687563723c9a48167971c095428f8bbb7f8c3572b5

  • SSDEEP

    6144:wDC5yQfvp9e4YbTaPnEu/+6i5j0RgeJWIaLiLC:4CBfvLoaPDHiOJge+

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

50.121.220.50:80

51.75.33.122:80

54.37.42.48:8080

91.121.54.71:8080

68.69.155.181:80

12.162.84.2:8080

77.55.211.77:8080

104.131.41.185:8080

85.105.140.135:443

51.255.165.160:8080

213.60.96.117:80

45.16.226.117:443

111.67.12.221:8080

190.6.193.152:8080

45.161.242.102:80

190.163.31.26:80

172.104.169.32:8080

185.94.252.12:80

212.174.55.22:443

50.28.51.143:8080
rsa_pubkey.plain

Targets

    • Target

      daf83e264f87da2a0801d101c8046de6_JaffaCakes118

    • Size

      272KB

    • MD5

      daf83e264f87da2a0801d101c8046de6

    • SHA1

      1a5d2346d1574de64378fdc382c8383e2cd89925

    • SHA256

      58c50898d344b65dea04f9577c9810e07544754ae24c81230310422288fa6cae

    • SHA512

      6f3b4e7ed8ccd77914b6f8745541434b1c5f32c7e6531d8fce238ce2b27e38305f524db1b318ff49616578687563723c9a48167971c095428f8bbb7f8c3572b5

    • SSDEEP

      6144:wDC5yQfvp9e4YbTaPnEu/+6i5j0RgeJWIaLiLC:4CBfvLoaPDHiOJge+

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks