Overview

overview

10

Static

static

10

0d83f49d40...bd.exe

windows7_x64

10

0d83f49d40...bd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd

  • Size

    70KB

  • Sample

    220222-yntg3sdah7

  • MD5

    04d2faf1ebd3cd7702da40bcdffb3a68

  • SHA1

    92eba2805cb13e85a5bd8cdec0c64920a7f9cd8f

  • SHA256

    0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd

  • SHA512

    1d5c4caf1c0347ba8bbc114cb4fd9cd5daf7fd430c7d5feb527cc57853da03b8f63e598587ddd6cc3b2b330412403a6315ad45c677eb1a131735697de1d93601

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

190.108.228.48:990

119.15.153.237:80

31.12.67.62:7080

80.11.163.139:21

190.226.44.20:21

45.33.49.124:443

103.97.95.218:143

187.144.189.58:50000

211.63.71.72:8080

182.76.6.2:8080

138.201.140.110:8080

190.145.67.134:8090

169.239.182.217:8080

46.105.131.87:80

78.24.219.147:8080

91.205.215.66:8080

85.104.59.244:20
rsa_pubkey.plain

Targets

    • Target

      0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd

    • Size

      70KB

    • MD5

      04d2faf1ebd3cd7702da40bcdffb3a68

    • SHA1

      92eba2805cb13e85a5bd8cdec0c64920a7f9cd8f

    • SHA256

      0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd

    • SHA512

      1d5c4caf1c0347ba8bbc114cb4fd9cd5daf7fd430c7d5feb527cc57853da03b8f63e598587ddd6cc3b2b330412403a6315ad45c677eb1a131735697de1d93601

    Score
    10/10
    emotetbankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks