Overview

overview

10

Static

static

3

e0a0a2b09b...18.exe

windows7-x64

10

e0a0a2b09b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0a0a2b09b6bab96d0e9aafcac4cd4b9_JaffaCakes118

  • Size

    524KB

  • Sample

    240914-vjtqhavcpq

  • MD5

    e0a0a2b09b6bab96d0e9aafcac4cd4b9

  • SHA1

    2d46309aaad443ef677ee8983424b47cf6b63f90

  • SHA256

    643ca72dd9d65ea2864062f9f1ea0498fa905a8d5c0a999c8e297aa26e2bed14

  • SHA512

    77088f5ca0a458da4f3a2bfc0aee1b7dbe6068cfe0342676ce12e77d26dd255832a6f41b23c7a9a49fc4ab7b6493716158943558f4eac168acef4ef3dbeefbe1

  • SSDEEP

    12288:qq8uwIgrH3m9HCYUvrI1jE3cIYoEV2KNGxsBcG:dpsVY9jWYoEIwGxs

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.4.172.5:443

186.4.172.5:8080

85.25.255.207:8080

185.94.252.13:443

94.177.216.217:8080

124.240.198.66:80

189.209.217.49:80

200.113.106.18:465

200.113.106.18:21

185.187.198.15:80

159.65.25.128:8080

87.106.136.232:8080

83.136.245.190:8080

212.71.234.16:8080

103.39.131.88:80

169.239.182.217:8080

136.243.177.26:8080

167.71.10.37:8080

201.250.54.115:50000

190.226.44.20:21
rsa_pubkey.plain

Targets

    • Target

      e0a0a2b09b6bab96d0e9aafcac4cd4b9_JaffaCakes118

    • Size

      524KB

    • MD5

      e0a0a2b09b6bab96d0e9aafcac4cd4b9

    • SHA1

      2d46309aaad443ef677ee8983424b47cf6b63f90

    • SHA256

      643ca72dd9d65ea2864062f9f1ea0498fa905a8d5c0a999c8e297aa26e2bed14

    • SHA512

      77088f5ca0a458da4f3a2bfc0aee1b7dbe6068cfe0342676ce12e77d26dd255832a6f41b23c7a9a49fc4ab7b6493716158943558f4eac168acef4ef3dbeefbe1

    • SSDEEP

      12288:qq8uwIgrH3m9HCYUvrI1jE3cIYoEV2KNGxsBcG:dpsVY9jWYoEIwGxs

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks