Overview

overview

10

Static

static

5cda2db5eb...89.exe

windows7_x64

10

5cda2db5eb...89.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5cda2db5eb7bd914f4bc7515f5482d517f11d3a8966e03ce8a3df1dfaa9e8289

  • Size

    584KB

  • Sample

    220226-kf6ksabder

  • MD5

    72a7a6ae439bf111a921b665af8461af

  • SHA1

    a04e824213d07eb1afea6e2edb67ff63357936c9

  • SHA256

    5cda2db5eb7bd914f4bc7515f5482d517f11d3a8966e03ce8a3df1dfaa9e8289

  • SHA512

    a247918f001fb79b5593a502e175fe47c1b5d325d89c7ca388d0ca90fd8efe8e8e602941989e974b99d9500deec4a52f94eb6ade57cf386db4ca462ad6782cc9

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80
rsa_pubkey.plain

Targets

    • Target

      5cda2db5eb7bd914f4bc7515f5482d517f11d3a8966e03ce8a3df1dfaa9e8289

    • Size

      584KB

    • MD5

      72a7a6ae439bf111a921b665af8461af

    • SHA1

      a04e824213d07eb1afea6e2edb67ff63357936c9

    • SHA256

      5cda2db5eb7bd914f4bc7515f5482d517f11d3a8966e03ce8a3df1dfaa9e8289

    • SHA512

      a247918f001fb79b5593a502e175fe47c1b5d325d89c7ca388d0ca90fd8efe8e8e602941989e974b99d9500deec4a52f94eb6ade57cf386db4ca462ad6782cc9

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks