Overview

overview

10

Static

static

3

f98bf8c1fe...18.exe

windows7-x64

10

f98bf8c1fe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f98bf8c1fecd7f62a34f1ed084800a36_JaffaCakes118

  • Size

    640KB

  • Sample

    240927-c2zqcsteke

  • MD5

    f98bf8c1fecd7f62a34f1ed084800a36

  • SHA1

    c06e1fd49b54d4f13f85fb6bbfecba59d375e08c

  • SHA256

    9fb79ad427373f05a61dae12aa26e21eee66a1a788a91b00df6eb60a01422b35

  • SHA512

    c3934e7022a00753afc5dda7414069ef7d6ef162d5b01498eaa68cbdb2328e484d37b3a2211945fc77f8e81ca3dc7eedfc5d9a847e258ebe7eb381651a7ed9f4

  • SSDEEP

    6144:Yp4TodyqywQwiaUlp2gpE8l512DVG81FGKU+Uk9nU5UKVPFEj3mmCXRsziR711Y:Yp4BwiagpM8AE81FGf+dYPa9UeiRU

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

202.153.220.157:80

190.85.46.52:7080

85.25.208.71:8081

162.144.42.60:8080

37.187.100.220:7080

74.208.173.91:8080

116.202.10.123:8080

157.245.138.101:7080

46.32.229.152:8080

192.241.220.183:8080

117.247.235.44:80

128.106.187.110:80

182.253.83.234:7080

178.33.167.120:8080

37.205.9.252:7080

179.5.118.12:80

80.200.62.81:20

37.210.220.95:80

45.177.120.37:8080

113.193.239.51:443
rsa_pubkey.plain

Targets

    • Target

      f98bf8c1fecd7f62a34f1ed084800a36_JaffaCakes118

    • Size

      640KB

    • MD5

      f98bf8c1fecd7f62a34f1ed084800a36

    • SHA1

      c06e1fd49b54d4f13f85fb6bbfecba59d375e08c

    • SHA256

      9fb79ad427373f05a61dae12aa26e21eee66a1a788a91b00df6eb60a01422b35

    • SHA512

      c3934e7022a00753afc5dda7414069ef7d6ef162d5b01498eaa68cbdb2328e484d37b3a2211945fc77f8e81ca3dc7eedfc5d9a847e258ebe7eb381651a7ed9f4

    • SSDEEP

      6144:Yp4TodyqywQwiaUlp2gpE8l512DVG81FGKU+Uk9nU5UKVPFEj3mmCXRsziR711Y:Yp4BwiagpM8AE81FGf+dYPa9UeiRU

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks