Overview

overview

10

Static

static

3

e3528b6c5f...18.exe

windows7-x64

10

e3528b6c5f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3528b6c5f3354718fd93ebb7366293e_JaffaCakes118

  • Size

    536KB

  • Sample

    240915-zjfk4a1gmf

  • MD5

    e3528b6c5f3354718fd93ebb7366293e

  • SHA1

    f0bb69a4f99b2da222bdd5a96d111bcbc17a786a

  • SHA256

    8ba7bf9d9729c5922c300efd822ed5d6e722d137fb1e145498392b3e1e3ce4d3

  • SHA512

    5de1133d3c9f2cc641f408bfa2b76ed014af03a25312021d92e881fdbfee0f1d91fc9f486a8954bffc765a24f2da2b5f13346d91565bdf4d9f56ec3720b40b0b

  • SSDEEP

    6144:O5B/k88jWYB5wdZskfKh7KNtzvruh9BkrLmlGvCzgK:U/k85OGekfkqvruBk/m86g

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

14.160.93.230:80

144.139.158.155:80

46.29.183.211:8080

23.229.115.217:8080

81.169.140.14:443

186.0.95.172:80

91.205.215.57:7080

201.163.74.202:443

5.196.35.138:7080

91.204.163.19:8090

86.42.166.147:80

200.58.83.179:80

181.59.253.20:21

46.101.212.195:8080

91.83.93.124:7080

68.183.170.114:8080

190.10.194.42:8080

190.230.60.129:8080

77.55.211.77:8080

220.241.38.226:50000
rsa_pubkey.plain

Targets

    • Target

      e3528b6c5f3354718fd93ebb7366293e_JaffaCakes118

    • Size

      536KB

    • MD5

      e3528b6c5f3354718fd93ebb7366293e

    • SHA1

      f0bb69a4f99b2da222bdd5a96d111bcbc17a786a

    • SHA256

      8ba7bf9d9729c5922c300efd822ed5d6e722d137fb1e145498392b3e1e3ce4d3

    • SHA512

      5de1133d3c9f2cc641f408bfa2b76ed014af03a25312021d92e881fdbfee0f1d91fc9f486a8954bffc765a24f2da2b5f13346d91565bdf4d9f56ec3720b40b0b

    • SSDEEP

      6144:O5B/k88jWYB5wdZskfKh7KNtzvruh9BkrLmlGvCzgK:U/k85OGekfkqvruBk/m86g

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks