Overview

overview

10

Static

static

MsSpellChe...in.exe

windows7_x64

10

MsSpellChe...in.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    MsSpellCheckingFacility.bin
  • Size 104KB
  • Sample200713-ssd5d6qpba
  • SHA256 1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 181.120.79.227:80

  • 91.236.4.234:443

  • 190.17.195.202:80

  • 104.131.103.37:8080

  • 190.147.137.153:443

  • 186.3.232.68:80

  • 190.163.1.31:8080

  • 143.0.87.101:80

  • 70.32.115.157:8080

  • 177.66.190.130:80

  • 82.196.15.205:8080

  • 77.90.136.129:8080

  • 175.114.178.83:443

  • 46.28.111.142:7080

  • 94.176.234.118:443

  • 114.109.179.60:80

  • 70.32.84.74:8080

  • 172.104.169.32:8080

  • 113.190.254.245:80

  • 81.169.202.3:443

rsa_pubkey.plain

Targets

    • Target
      MsSpellCheckingFacility.bin
    • Size 104KB
    • SHA256 1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks