emotet_exe_e1_4b91092e60ce4a32502fcb9489722108d033beac779e5f229743a666c05d3041_2020-11-19__145146._exe

Target

Size

432KB

Sample

201119-x55kh54nfs

Score

10 ^/10

MD5

99741f11d5f67e1305b317cb51ae315f

SHA1

df40f59684f1b440e6c955c5a59ae159e421c4f7

SHA256

ff63368c331815393e5743a7ddc828adcba51a3dbfca0b51e81c66bc615d3d5c

SHA512

e4918668400b66ca90d2374d48ec8f1cdd802861595479f4f578adaf8433889016123dcc5d1bfc8ec6cd8bced44c1c050eae570b6b3d4005cd9bbcf7f5408252

Extracted

Family	emotet
Botnet	Epoch1
C2	181.30.61.163:443 209.126.6.222:8080 5.153.250.14:8080 188.135.15.49:80 104.131.41.185:8080 178.250.54.208:8080 50.28.51.143:8080 170.81.48.2:80 87.106.46.107:8080 191.99.160.58:80 187.162.248.237:80 89.32.150.160:8080 46.28.111.142:7080 190.190.148.27:8080 190.115.18.139:8080 178.79.163.131:8080 73.213.208.163:80 219.92.8.17:8080 95.9.180.128:80 212.71.237.140:8080 82.196.15.205:8080 111.67.12.221:8080 24.135.198.218:80 202.4.57.96:80 61.92.159.208:8080 80.249.176.206:80 77.90.136.129:8080 81.129.198.57:80 58.171.153.81:80 217.13.106.14:8080 24.148.98.177:80 51.255.165.160:8080 190.6.193.152:8080 149.62.173.247:8080 94.206.45.18:80 137.74.106.111:7080 190.195.129.227:8090 85.109.159.61:443 207.144.103.227:80 91.219.169.180:80 217.199.160.224:7080 104.131.103.37:8080 83.169.21.32:7080 82.163.245.38:80 204.225.249.100:7080 152.169.22.67:80 45.161.242.102:80 65.36.62.20:80 185.94.252.27:443 116.125.120.88:443 190.24.243.186:80 190.147.137.153:443 190.128.173.10:80 192.241.146.84:8080 186.250.52.226:8080 68.183.170.114:8080 45.173.88.33:80 12.162.84.2:8080 185.33.0.233:80 68.183.190.199:8080 73.116.193.136:80 213.60.96.117:80 189.2.177.210:443 186.103.141.250:443 177.73.0.98:443 72.47.248.48:7080 2.47.112.152:80 181.129.96.162:8080 5.196.35.138:7080 185.94.252.12:80 190.163.31.26:80 94.176.234.118:443 70.32.84.74:8080 213.176.36.147:8080 114.109.179.60:80 177.74.228.34:80 186.70.127.199:8090 174.100.27.229:80 45.33.77.42:8080 212.93.117.170:80 219.92.13.25:80 188.2.217.94:80 77.55.211.77:8080 172.104.169.32:8080 85.105.140.135:443 209.236.123.42:8080 70.32.115.157:8080 24.135.1.177:80 82.76.111.249:443 192.241.143.52:8080 51.159.23.217:443 191.182.6.118:80 67.247.242.247:80 177.72.13.80:80 181.30.61.163:443 209.126.6.222:8080 5.153.250.14:8080 188.135.15.49:80 104.131.41.185:8080 178.250.54.208:8080 50.28.51.143:8080 170.81.48.2:80 87.106.46.107:8080 191.99.160.58:80 187.162.248.237:80 89.32.150.160:8080 46.28.111.142:7080 190.190.148.27:8080 190.115.18.139:8080 178.79.163.131:8080 73.213.208.163:80 219.92.8.17:8080 95.9.180.128:80 212.71.237.140:8080 82.196.15.205:8080 111.67.12.221:8080 24.135.198.218:80 202.4.57.96:80 61.92.159.208:8080 80.249.176.206:80 77.90.136.129:8080 81.129.198.57:80 58.171.153.81:80 217.13.106.14:8080 24.148.98.177:80 51.255.165.160:8080 190.6.193.152:8080 149.62.173.247:8080 94.206.45.18:80 137.74.106.111:7080 190.195.129.227:8090 85.109.159.61:443 207.144.103.227:80 91.219.169.180:80 217.199.160.224:7080 104.131.103.37:8080 83.169.21.32:7080 82.163.245.38:80 204.225.249.100:7080 152.169.22.67:80 45.161.242.102:80 65.36.62.20:80 185.94.252.27:443 116.125.120.88:443 190.24.243.186:80 190.147.137.153:443 190.128.173.10:80 192.241.146.84:8080 186.250.52.226:8080 68.183.170.114:8080 45.173.88.33:80 12.162.84.2:8080 185.33.0.233:80 68.183.190.199:8080 73.116.193.136:80 213.60.96.117:80 189.2.177.210:443 186.103.141.250:443 177.73.0.98:443 72.47.248.48:7080 2.47.112.152:80 181.129.96.162:8080 5.196.35.138:7080 185.94.252.12:80 190.163.31.26:80 94.176.234.118:443 70.32.84.74:8080 213.176.36.147:8080 114.109.179.60:80 177.74.228.34:80 186.70.127.199:8090 174.100.27.229:80 45.33.77.42:8080 212.93.117.170:80 219.92.13.25:80 188.2.217.94:80 77.55.211.77:8080 172.104.169.32:8080 85.105.140.135:443 209.236.123.42:8080 70.32.115.157:8080 24.135.1.177:80 82.76.111.249:443 192.241.143.52:8080 51.159.23.217:443 191.182.6.118:80 67.247.242.247:80 177.72.13.80:80
rsa_pubkey.plain

Target

emotet_exe_e1_4b91092e60ce4a32502fcb9489722108d033beac779e5f229743a666c05d3041_2020-11-19__145146._exe

MD5

99741f11d5f67e1305b317cb51ae315f

Filesize

432KB

Score

10 ^/10

SHA1

df40f59684f1b440e6c955c5a59ae159e421c4f7

SHA256

ff63368c331815393e5743a7ddc828adcba51a3dbfca0b51e81c66bc615d3d5c

SHA512

e4918668400b66ca90d2374d48ec8f1cdd802861595479f4f578adaf8433889016123dcc5d1bfc8ec6cd8bced44c1c050eae570b6b3d4005cd9bbcf7f5408252

Signatures

Emotet

Description

Emotet is a trojan that is primarily spread through spam emails.

Tags

trojan banker emotet
Emotet Payload

Description

Detects Emotet payload in memory.

Related Tasks

behavioral1

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

behavioral1

emotet epoch1 banker trojan

10^/10

Extracted

Tags

Signatures

Emotet

Description

Tags

Emotet Payload

Description

Related Tasks

static1

behavioral1