OwM.exe

Target

OwM.exe

Size

352KB

Sample

201118-76xzhmmraa

Score

10 ^/10

MD5

6d1b5143db2fe11b313248fc9714408a

SHA1

8a6e83834db5b15af90dcaaa9e27187a2834f068

SHA256

9d67cfa82ab85d6579b976983b21d80237a08fb1d5400210e8072032858b7aba

SHA512

61bf57a37e6ccf140d39714524af20b223a124ddb79b28ba6e434878fa2a412bda201de6d816e7e4c947b08aa74d1b6c17d736920eb9057fccb4927bbfdf96b8

Extracted

Family	emotet
Botnet	Epoch3
C2	152.32.75.74:443 91.121.200.35:8080 159.203.16.11:8080 188.226.165.170:8080 172.193.79.237:80 123.216.134.52:80 183.91.3.63:80 139.59.61.215:443 185.80.172.199:80 77.74.78.80:443 153.229.219.1:443 113.203.238.130:80 120.51.34.254:80 116.202.10.123:8080 5.2.246.108:80 50.116.78.109:8080 103.80.51.61:8080 190.55.186.229:80 185.142.236.163:443 223.17.215.76:80 188.80.27.54:80 78.90.78.210:80 213.165.178.214:80 82.78.179.117:443 178.33.167.120:8080 58.27.215.3:8080 190.212.140.6:80 177.130.51.198:80 187.193.221.143:80 190.194.12.132:80 5.79.70.250:8080 2.82.75.215:80 79.133.6.236:8080 8.4.9.137:8080 188.166.220.180:7080 203.56.191.129:8080 58.94.58.13:80 189.123.103.233:80 190.180.65.104:80 54.38.143.245:8080 46.105.131.68:8080 119.228.75.211:80 162.144.145.58:8080 36.91.44.183:80 41.76.213.144:8080 202.29.237.113:8080 47.154.85.229:80 42.200.96.63:80 195.201.56.70:8080 41.185.29.128:8080 74.208.173.91:8080 91.83.93.103:443 126.126.139.26:443 190.85.46.52:7080 103.229.73.17:8080 203.153.216.178:7080 192.163.221.191:8080 113.161.148.81:80 115.79.59.157:80 78.101.224.151:80 73.55.128.120:80 180.148.4.130:8080 2.58.16.86:8080 192.210.217.94:8080 117.2.139.117:443 139.59.12.63:8080 179.5.118.12:80 5.2.164.75:80 178.254.36.182:8080 175.103.38.146:80 192.241.220.183:8080 198.20.228.9:8080 115.79.195.246:80 45.239.204.100:80 200.243.153.66:80 109.13.179.195:80 37.205.9.252:7080 172.105.78.244:8080 109.99.146.210:8080 121.117.147.153:443 46.32.229.152:8080 143.95.101.72:8080 157.7.164.178:8081 37.46.129.215:8080 73.100.19.104:80 181.59.59.54:80 5.12.246.155:80 60.108.128.186:80 185.208.226.142:8080 110.37.224.243:80 172.96.190.154:8080 75.127.14.170:8080 51.38.50.144:8080 103.93.220.182:80 109.206.139.119:80 95.76.142.243:80 190.164.135.81:80 190.192.39.136:80 197.221.227.78:80 85.246.78.192:80 91.75.75.46:80 152.32.75.74:443 91.121.200.35:8080 159.203.16.11:8080 188.226.165.170:8080 172.193.79.237:80 123.216.134.52:80 183.91.3.63:80 139.59.61.215:443 185.80.172.199:80 77.74.78.80:443 153.229.219.1:443 113.203.238.130:80 120.51.34.254:80 116.202.10.123:8080 5.2.246.108:80 50.116.78.109:8080 103.80.51.61:8080 190.55.186.229:80 185.142.236.163:443 223.17.215.76:80 188.80.27.54:80 78.90.78.210:80 213.165.178.214:80 82.78.179.117:443 178.33.167.120:8080 58.27.215.3:8080 190.212.140.6:80 177.130.51.198:80 187.193.221.143:80 190.194.12.132:80 5.79.70.250:8080 2.82.75.215:80 79.133.6.236:8080 8.4.9.137:8080 188.166.220.180:7080 203.56.191.129:8080 58.94.58.13:80 189.123.103.233:80 190.180.65.104:80 54.38.143.245:8080 46.105.131.68:8080 119.228.75.211:80 162.144.145.58:8080 36.91.44.183:80 41.76.213.144:8080 202.29.237.113:8080 47.154.85.229:80 42.200.96.63:80 195.201.56.70:8080 41.185.29.128:8080 74.208.173.91:8080 91.83.93.103:443 126.126.139.26:443 190.85.46.52:7080 103.229.73.17:8080 203.153.216.178:7080 192.163.221.191:8080 113.161.148.81:80 115.79.59.157:80 78.101.224.151:80 73.55.128.120:80 180.148.4.130:8080 2.58.16.86:8080 192.210.217.94:8080 117.2.139.117:443 139.59.12.63:8080 179.5.118.12:80 5.2.164.75:80 178.254.36.182:8080 175.103.38.146:80 192.241.220.183:8080 198.20.228.9:8080 115.79.195.246:80 45.239.204.100:80 200.243.153.66:80 109.13.179.195:80 37.205.9.252:7080 172.105.78.244:8080 109.99.146.210:8080 121.117.147.153:443 46.32.229.152:8080 143.95.101.72:8080 157.7.164.178:8081 37.46.129.215:8080 73.100.19.104:80 181.59.59.54:80 5.12.246.155:80 60.108.128.186:80 185.208.226.142:8080 110.37.224.243:80 172.96.190.154:8080 75.127.14.170:8080 51.38.50.144:8080 103.93.220.182:80 109.206.139.119:80 95.76.142.243:80 190.164.135.81:80 190.192.39.136:80 197.221.227.78:80 85.246.78.192:80 91.75.75.46:80
rsa_pubkey.plain

Target

OwM.exe

MD5

6d1b5143db2fe11b313248fc9714408a

Filesize

352KB

Score

10 ^/10

SHA1

8a6e83834db5b15af90dcaaa9e27187a2834f068

SHA256

9d67cfa82ab85d6579b976983b21d80237a08fb1d5400210e8072032858b7aba

SHA512

61bf57a37e6ccf140d39714524af20b223a124ddb79b28ba6e434878fa2a412bda201de6d816e7e4c947b08aa74d1b6c17d736920eb9057fccb4927bbfdf96b8

Signatures

Emotet

Description

Emotet is a trojan that is primarily spread through spam emails.

Tags

trojan banker emotet
Emotet Payload

Description

Detects Emotet payload in memory.

Related Tasks

behavioral1

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

behavioral1

emotet epoch3 banker trojan

10^/10

Extracted

Tags

Signatures

Emotet

Description

Tags

Emotet Payload

Description

Related Tasks

static1

behavioral1