Overview

overview

10

Static

static

emotet_exe...xe.dll

windows7_x64

10

emotet_exe...xe.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    emotet_exe_e3_0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0_2020-12-23__000408.exe
  • Size 271KB
  • Sample201223-4hxdd3spae
  • SHA256 0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 5.83.32.101:80

  • 110.172.180.180:8080

  • 203.157.152.9:7080

  • 157.245.145.87:443

  • 195.159.28.244:8080

  • 116.202.10.123:8080

  • 175.103.38.146:80

  • 115.79.59.157:80

  • 188.226.165.170:8080

  • 58.27.215.3:8080

  • 91.83.93.103:443

  • 49.206.31.122:80

  • 120.51.34.254:80

  • 2.58.16.86:8080

  • 5.79.70.250:8080

  • 54.38.143.245:8080

  • 27.78.27.110:443

  • 45.230.45.171:443

  • 74.208.173.91:8080

  • 46.32.229.152:8080

rsa_pubkey.plain

Targets

    • Target
      emotet_exe_e3_0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0_2020-12-23__000408.exe
    • Size 271KB
    • SHA256 0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks