Overview

overview

10

Static

static

3

dce9fa4931...18.exe

windows7-x64

10

dce9fa4931...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dce9fa4931a42f9aaf77a62bb6826fe1_JaffaCakes118

  • Size

    504KB

  • Sample

    240912-yaj2gszhqm

  • MD5

    dce9fa4931a42f9aaf77a62bb6826fe1

  • SHA1

    b271b9455dc1b0d4034d92eccbfdc21c3dfb065a

  • SHA256

    afaef252d19ea130ed1e850cea8c0acec5dcca3f8110f58e33e0588dcd6f999c

  • SHA512

    9d8247c7028e8a260ab627a71f0845b8729920cb7a962d5ba392397ddf5bff65f40a282ff68696c0f2519aaa591c2947fdc186532578d754a3d0a17b47b34c50

  • SSDEEP

    12288:tYUfuKq21VoikY0P56pQW1iUfifuS4URn:thuKq21lkY0PgpQ8iSOuSzn

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.91.208.86:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

107.5.122.110:80

103.86.49.11:8080

85.105.205.77:8080

120.150.60.189:80

137.59.187.107:8080

139.59.60.244:8080

203.117.253.142:80

1.221.254.82:80

97.82.79.83:80

37.187.72.193:8080

139.99.158.11:443

152.168.248.128:443

74.208.45.104:8080

83.169.36.251:8080

169.239.182.217:8080

216.208.76.186:80
rsa_pubkey.plain

Targets

    • Target

      dce9fa4931a42f9aaf77a62bb6826fe1_JaffaCakes118

    • Size

      504KB

    • MD5

      dce9fa4931a42f9aaf77a62bb6826fe1

    • SHA1

      b271b9455dc1b0d4034d92eccbfdc21c3dfb065a

    • SHA256

      afaef252d19ea130ed1e850cea8c0acec5dcca3f8110f58e33e0588dcd6f999c

    • SHA512

      9d8247c7028e8a260ab627a71f0845b8729920cb7a962d5ba392397ddf5bff65f40a282ff68696c0f2519aaa591c2947fdc186532578d754a3d0a17b47b34c50

    • SSDEEP

      12288:tYUfuKq21VoikY0P56pQW1iUfifuS4URn:thuKq21lkY0PgpQ8iSOuSzn

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks