Overview

overview

10

Static

static

SlurpeeEXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    871c10ba6132d03fc8a785771b4db6cdcdba696da823b487bf7bb1da5ff72d7a.zip

  • Size

    128KB

  • Sample

    210125-2cmjrcfnza

  • MD5

    f5c10e797dcef4284c031865ea3e37d3

  • SHA1

    ed2a6e238174b34457c279a27e1ce66263a498df

  • SHA256

    2517d8ee8eaecb06cbea2dde0a3f3a5d78c85350bd11e4e7dc1579ac93a9c6a3

  • SHA512

    c157b4be728f9bc118f52a4262003b554fecaf416e870c5c2b837e0d9caf5925752389f047b7418bc0378eaaf8172ff772f17538fb5fbcd678462db29249f9cc

Score
10/10
emotetepoch2bankerransomwaretrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80
rsa_pubkey.plain

Targets

    • Target

      871c10ba6132d03fc8a785771b4db6cdcdba696da823b487bf7bb1da5ff72d7a.dll

    • Size

      327KB

    • MD5

      11478b820fb5306fceb9995dfe9ce092

    • SHA1

      e6b0267eb0ad7315f387d0501f4008a4339990a6

    • SHA256

      871c10ba6132d03fc8a785771b4db6cdcdba696da823b487bf7bb1da5ff72d7a

    • SHA512

      eda7d9ee4e98080cedde9ae5a9911215c9623a82c7b027928a9da0a934e94f5999e8112dc5aa5c75a6020e42bd27d0de07264399859f21c19afada0bba70ab39

    Score
    10/10
    emotetepoch2bankerransomwaretrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks