Overview

overview

10

Static

static

9

381fe5b3c4...80.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6271467933302784.zip

  • Size

    151KB

  • Sample

    210916-v3hscadha2

  • MD5

    c872bcbf7e1dab7ff284a1a16d8c6780

  • SHA1

    07ce9811b78f52f90710d15af98c334eb94abf54

  • SHA256

    00854a6002b2b1218400be6d65bead8923424481ffd84d881445451e840e8169

  • SHA512

    fde6be8ad4b9ba98632361e61bc9a18f202f7e84f0ff0048981860a5f65e3e67c21c0e8f43809e310700b6171f684135edadaf1b1ae66aaeaf277c20569e445c

Score
10/10
emotetepoch2bankercryptonepackertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

124.240.198.66:80

186.75.241.230:80

181.143.194.138:443

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

190.211.207.11:443

78.188.105.159:21

182.176.106.43:995

178.79.161.166:443

206.189.98.125:8080

87.230.19.21:8080

80.11.163.139:443

101.187.237.217:20

190.18.146.70:80

86.98.25.30:53

92.222.125.16:7080

186.4.172.5:443
rsa_pubkey.plain

Targets

    • Target

      381fe5b3c4d640baf1495ad7f3e111af78c88df250895d87979834f952953580

    • Size

      474KB

    • MD5

      604a044f20590d8486489d2b736e47fa

    • SHA1

      8152a4a20292751f381b4a6d0bbce1c2f04739af

    • SHA256

      381fe5b3c4d640baf1495ad7f3e111af78c88df250895d87979834f952953580

    • SHA512

      89ba0d68c69ceef5956e692c2b6a8c07ff62ff0f1931b339d60252481864960c0109cd19731fca10acd659c3f7f52f7b94d8b060d4cf6483c653967dc1eedf39

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks