Overview

overview

10

Static

static

Win7: 5min timeout

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    demo2

  • Size

    572KB

  • Sample

    210420-eyxjyra112

  • MD5

    63e7951323a58e88eb1b54fdd85b592c

  • SHA1

    1a42fddedb5584d8f6a94f361fb1c0d00c14ee9b

  • SHA256

    81911568cdd70019efa3d4d57c293999180989d73c41ff215e5e0c3632333fc9

  • SHA512

    a1220a8f82d66df778f058295be5d6b8fad9f5ff9d710b0b373f6302d35fcfa98660d71447179efa50703dc6c05835789e20f151f3739ba71aa76bc4b2c72528

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.186.191.177:80

91.242.138.5:80

173.13.135.102:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

80.11.163.139:21

182.176.132.213:8090

165.227.156.155:443

118.201.230.249:80

138.201.140.110:8080

46.105.131.87:80

87.106.139.101:8080

24.45.193.161:7080

209.97.168.52:8080

190.12.119.180:443

190.147.215.53:22

191.92.209.110:7080

91.205.215.66:8080
rsa_pubkey.plain

Targets

    • Target

      demo2

    • Size

      572KB

    • MD5

      63e7951323a58e88eb1b54fdd85b592c

    • SHA1

      1a42fddedb5584d8f6a94f361fb1c0d00c14ee9b

    • SHA256

      81911568cdd70019efa3d4d57c293999180989d73c41ff215e5e0c3632333fc9

    • SHA512

      a1220a8f82d66df778f058295be5d6b8fad9f5ff9d710b0b373f6302d35fcfa98660d71447179efa50703dc6c05835789e20f151f3739ba71aa76bc4b2c72528

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks