Overview

overview

10

Static

static

6b7ebd5fb9...29.exe

windows7_x64

10

6b7ebd5fb9...29.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
  • Size 528KB
  • Sample201108-ret9b9dekj
  • SHA256 6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 186.92.11.143:8080

  • 200.30.227.135:80

  • 178.249.187.151:8080

  • 81.169.140.14:443

  • 94.177.183.28:8080

  • 89.188.124.145:443

  • 185.86.148.222:8080

  • 82.196.15.205:8080

  • 77.245.101.134:8080

  • 217.199.160.224:8080

  • 76.69.29.42:80

  • 181.59.253.20:21

  • 46.28.111.142:7080

  • 149.62.173.247:8080

  • 200.58.83.179:80

  • 190.230.60.129:80

  • 181.36.42.205:443

  • 190.97.30.167:990

  • 46.29.183.211:8080

  • 87.106.77.40:7080

rsa_pubkey.plain

Targets

    • Target
      6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
    • Size 528KB
    • SHA256 6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetbankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks