Overview

overview

10

Static

static

10

af5fc538e1...43.exe

windows7_x64

10

af5fc538e1...43.exe

windows10-2004_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af5fc538e16f67a0d5e7ae41a7228fd6b9b95a5517fefd0ff65d0198f2487043

  • Size

    57KB

  • Sample

    220306-t3wtjaced2

  • MD5

    684b1d575f9d9360b89d71b0c96a6093

  • SHA1

    1c65552207778c551d922c7a68d74b432552c6e4

  • SHA256

    af5fc538e16f67a0d5e7ae41a7228fd6b9b95a5517fefd0ff65d0198f2487043

  • SHA512

    f3fcc669283e144db4adc8150b7c2ab4feafb1a888152dae7ac2909e9f53b01398823b11523765778bca88e27924a37e58d31bbcdbab102949f1800c572cdb6b

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

201.184.105.242:443

24.45.195.162:7080

24.45.195.162:8443

94.192.225.46:80

80.11.163.139:443

133.167.80.63:7080

198.199.114.69:8080

80.79.23.144:443

192.254.173.31:8080

67.225.229.55:8080

190.108.228.48:990

62.75.187.192:8080

185.94.252.13:443

94.205.247.10:80

211.63.71.72:8080

59.103.164.174:80

192.81.213.192:8080

27.4.80.183:443

190.145.67.134:8090

115.78.95.230:443
rsa_pubkey.plain

Targets

    • Target

      af5fc538e16f67a0d5e7ae41a7228fd6b9b95a5517fefd0ff65d0198f2487043

    • Size

      57KB

    • MD5

      684b1d575f9d9360b89d71b0c96a6093

    • SHA1

      1c65552207778c551d922c7a68d74b432552c6e4

    • SHA256

      af5fc538e16f67a0d5e7ae41a7228fd6b9b95a5517fefd0ff65d0198f2487043

    • SHA512

      f3fcc669283e144db4adc8150b7c2ab4feafb1a888152dae7ac2909e9f53b01398823b11523765778bca88e27924a37e58d31bbcdbab102949f1800c572cdb6b

    Score
    10/10
    emotetbankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks