Overview

overview

10

Static

static

5b88192ff0...ab.dll

windows7_x64

10

5b88192ff0...ab.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b88192ff085657a88f5632cbd6a77f0814eda5dd364c0fb37b0dcf42f6970ab

  • Size

    322KB

  • Sample

    220317-xcaedseab7

  • MD5

    381b62b801114de3d63a55a51e089e46

  • SHA1

    b22c5f26d442992304d10dbd4789693576423dcf

  • SHA256

    5b88192ff085657a88f5632cbd6a77f0814eda5dd364c0fb37b0dcf42f6970ab

  • SHA512

    db999852d947fd2949116287a0ef19d1a6049f4c67c280bf833b09711760fcb5db3147c20295966c5b757e5508754384dbfe8f831ab28e7d1ebadb9863ec640c

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

197.87.160.216:80

78.188.225.105:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

188.219.31.12:80

157.245.99.39:8080

172.125.40.123:80

62.30.7.67:443

120.150.60.189:80

109.74.5.95:8080

67.10.155.92:80

67.170.250.203:443

2.58.16.89:8080

186.74.215.34:80

202.141.243.254:443

118.83.154.64:443

172.86.188.251:8080

37.187.72.193:8080

87.106.139.101:8080
rsa_pubkey.plain

Targets

    • Target

      5b88192ff085657a88f5632cbd6a77f0814eda5dd364c0fb37b0dcf42f6970ab

    • Size

      322KB

    • MD5

      381b62b801114de3d63a55a51e089e46

    • SHA1

      b22c5f26d442992304d10dbd4789693576423dcf

    • SHA256

      5b88192ff085657a88f5632cbd6a77f0814eda5dd364c0fb37b0dcf42f6970ab

    • SHA512

      db999852d947fd2949116287a0ef19d1a6049f4c67c280bf833b09711760fcb5db3147c20295966c5b757e5508754384dbfe8f831ab28e7d1ebadb9863ec640c

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet3

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks