Overview

overview

10

Static

static

3

e4cae9f71b...18.exe

windows7-x64

10

e4cae9f71b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4cae9f71bc5891400bd14a8bbeef0b2_JaffaCakes118

  • Size

    156KB

  • Sample

    240916-pw4hksyajl

  • MD5

    e4cae9f71bc5891400bd14a8bbeef0b2

  • SHA1

    7513c318844129342f332e9b5c3ce905f517c5ab

  • SHA256

    fbe74686f66f881eb81bfc1a648da7df86bc7c91e532016ac035435484466bb6

  • SHA512

    689fccc08ddaa47363757b42d3c954ff232f0b7e0e0dff6dbecfad2ce734357e85797fbe32484f6b0a33f4cb1ad96326cfa75a24c53f480c4821183286a539a9

  • SSDEEP

    1536:UXGNxEKJx6qdlaPLA1tjUb6vfEwDfJ8rWR0hoZjeZtaNT6hSegcAe6frjq8jI:cGnEKJx6q6zUqOr5Z4aNipDj6f/qn

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.146.32.175:80

212.51.142.238:8080

200.55.243.138:8080

114.146.222.200:80

153.126.210.205:7080

121.124.124.40:7080

222.214.218.37:4143

67.241.24.163:8080

180.92.239.110:8080

203.153.216.189:7080

119.198.40.179:80

70.167.215.250:8080

168.235.67.138:7080

190.55.181.54:443

139.59.60.244:8080

189.212.199.126:443

78.24.219.147:8080

61.19.246.238:443

137.59.187.107:8080

87.106.139.101:8080
rsa_pubkey.plain

Targets

    • Target

      e4cae9f71bc5891400bd14a8bbeef0b2_JaffaCakes118

    • Size

      156KB

    • MD5

      e4cae9f71bc5891400bd14a8bbeef0b2

    • SHA1

      7513c318844129342f332e9b5c3ce905f517c5ab

    • SHA256

      fbe74686f66f881eb81bfc1a648da7df86bc7c91e532016ac035435484466bb6

    • SHA512

      689fccc08ddaa47363757b42d3c954ff232f0b7e0e0dff6dbecfad2ce734357e85797fbe32484f6b0a33f4cb1ad96326cfa75a24c53f480c4821183286a539a9

    • SSDEEP

      1536:UXGNxEKJx6qdlaPLA1tjUb6vfEwDfJ8rWR0hoZjeZtaNT6hSegcAe6frjq8jI:cGnEKJx6q6zUqOr5Z4aNipDj6f/qn

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks