Overview

overview

10

Static

static

3

ea0c9fe52f...18.exe

windows7-x64

10

ea0c9fe52f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea0c9fe52f6f5fe6b5e17a5bb7fb75f4_JaffaCakes118

  • Size

    672KB

  • Sample

    240918-1yc9ysvgkd

  • MD5

    ea0c9fe52f6f5fe6b5e17a5bb7fb75f4

  • SHA1

    df5fae7700547d5d65976db184c62b87473da82c

  • SHA256

    c2c22176068f9cfbf780101f5cc2b025926faa574656c8ba3fb32d3c25eab438

  • SHA512

    a18b435393b6de6f223dd3cf9ede9aab48ad4924510e7fbe25aeb4dceea28549ade44057d7d2e26d8a9e2deb81d8c71573b0361f359bb6ac145550abecb0ee1e

  • SSDEEP

    12288:bUILKCNARjwrJ8//CIrqs8h3bfytwX2+N:jS5qJ8/Jrqs2utwX2

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

190.12.119.180:443

47.50.251.130:80

107.2.2.28:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

186.75.241.230:80

59.103.164.174:80

209.97.168.52:8080

31.12.67.62:7080

206.189.112.148:8080

83.136.245.190:8080

189.209.217.49:80

87.230.19.21:8080

190.53.135.159:21

120.150.246.241:80

91.205.215.66:8080

128.65.154.183:443

104.236.246.93:8080
rsa_pubkey.plain

Targets

    • Target

      ea0c9fe52f6f5fe6b5e17a5bb7fb75f4_JaffaCakes118

    • Size

      672KB

    • MD5

      ea0c9fe52f6f5fe6b5e17a5bb7fb75f4

    • SHA1

      df5fae7700547d5d65976db184c62b87473da82c

    • SHA256

      c2c22176068f9cfbf780101f5cc2b025926faa574656c8ba3fb32d3c25eab438

    • SHA512

      a18b435393b6de6f223dd3cf9ede9aab48ad4924510e7fbe25aeb4dceea28549ade44057d7d2e26d8a9e2deb81d8c71573b0361f359bb6ac145550abecb0ee1e

    • SSDEEP

      12288:bUILKCNARjwrJ8//CIrqs8h3bfytwX2+N:jS5qJ8/Jrqs2utwX2

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks