Overview

overview

10

Static

static

emotet_exe...xe.exe

windows7_x64

10

emotet_exe...xe.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_exe_e1_001588e09c39c49964e12f781e30d12bdde8bdb799b5859f9b2225518f7b5d1d_2020-07-29__052658._exe

  • Size

    688KB

  • Sample

    200729-xnfq85etja

  • MD5

    b7f8aaaa75c6ffcd3ed95e9abcf41cf7

  • SHA1

    e26f21c62a6266b9a2c9531292beb8b469e396f5

  • SHA256

    001588e09c39c49964e12f781e30d12bdde8bdb799b5859f9b2225518f7b5d1d

  • SHA512

    2be433bd57539b61f2e360434971b1c60e72df7f3396aff9c38b1393026f7946044da47a720789815ba5b422fd27d62db61eac3b8a734ab6bdbc38a3e453431a

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

179.60.229.168:443

185.94.252.13:443

189.218.165.63:80

77.90.136.129:8080

217.199.160.224:7080

104.131.41.185:8080

2.47.112.152:80

185.94.252.27:443

186.250.52.226:8080

51.255.165.160:8080

68.183.170.114:8080

191.99.160.58:80

104.131.103.37:8080

181.31.211.181:80

202.62.39.111:80

83.169.21.32:7080

87.106.46.107:8080

72.47.248.48:7080

177.75.143.112:443

190.17.195.202:80
rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e1_001588e09c39c49964e12f781e30d12bdde8bdb799b5859f9b2225518f7b5d1d_2020-07-29__052658._exe

    • Size

      688KB

    • MD5

      b7f8aaaa75c6ffcd3ed95e9abcf41cf7

    • SHA1

      e26f21c62a6266b9a2c9531292beb8b469e396f5

    • SHA256

      001588e09c39c49964e12f781e30d12bdde8bdb799b5859f9b2225518f7b5d1d

    • SHA512

      2be433bd57539b61f2e360434971b1c60e72df7f3396aff9c38b1393026f7946044da47a720789815ba5b422fd27d62db61eac3b8a734ab6bdbc38a3e453431a

    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet Payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks