6f42d9158ac6f371098ca9976cb2023ae3826b3a074c7d9f717106f0bcac4bc5

Target

Size

362KB

Sample

220521-x59d7agagp

Score

10 ^/10

MD5

d4337de652256321b79f131b3ce4c82e

SHA1

1960ccbc5269143e53a8d32dd623488db8c630cd

SHA256

6f42d9158ac6f371098ca9976cb2023ae3826b3a074c7d9f717106f0bcac4bc5

SHA512

6c0f6890f1ccdc3373d9b2e60eecb9317d72e27201acd23d0d82c6df3ebf062162085bc4c25cfd39c9d76cbdea4b0d686937e83b4446bee91f67e7022b33b70e

Extracted

Family	emotet
Botnet	Epoch5
C2	194.9.172.107:8080 66.42.57.149:443 165.22.73.229:8080 202.29.239.162:443 76.189.152.228:1645 59.185.164.123:8382 115.19.43.159:30377 104.248.225.227:8080 54.38.242.185:443 103.133.214.242:8080 78.47.204.80:443 210.57.209.142:8080 103.41.204.169:8080 118.98.72.86:443 88.217.172.165:8080 87.106.97.83:7080 85.25.120.45:8080 195.77.239.39:8080 37.44.244.177:8080 36.67.23.59:443 93.41.142.108:30345 42.6.66.255:39545 160.16.143.191:7080 38.217.125.207:49663 54.38.143.246:7080 159.69.237.188:443 68.183.93.250:443 54.37.228.122:443 190.90.233.66:443 37.59.209.141:8080 29.146.139.51:30005 18.37.240.161:6409 178.62.112.199:8080 59.148.253.194:443 196.44.98.190:8080 79.235.8.209:58224 202.28.34.99:8080 78.46.73.125:443 51.68.141.164:8080 207.148.81.119:8080 93.104.209.107:8080 185.148.168.220:8080 100.21.231.107:63582 103.85.95.4:8080 62.171.178.147:8080 175.126.176.79:8080 134.122.119.23:8080 202.134.4.210:7080 116.124.128.206:8080 45.71.195.104:8080 110.235.83.107:7080 103.56.149.105:8080 68.183.91.111:8080 119.44.217.160:39748 5.56.132.177:8080 195.154.146.35:443 217.182.143.207:443 54.37.106.167:8080 85.214.67.203:8080 90.63.125.244:30283 188.225.32.231:4143 103.42.58.120:7080 139.196.72.155:8080 194.9.172.107:8080 66.42.57.149:443 165.22.73.229:8080 202.29.239.162:443 76.189.152.228:1645 59.185.164.123:8382 115.19.43.159:30377 104.248.225.227:8080 54.38.242.185:443 103.133.214.242:8080 78.47.204.80:443 210.57.209.142:8080 103.41.204.169:8080 118.98.72.86:443 88.217.172.165:8080 87.106.97.83:7080 85.25.120.45:8080 195.77.239.39:8080 37.44.244.177:8080 36.67.23.59:443 93.41.142.108:30345 42.6.66.255:39545 160.16.143.191:7080 38.217.125.207:49663 54.38.143.246:7080 159.69.237.188:443 68.183.93.250:443 54.37.228.122:443 190.90.233.66:443 37.59.209.141:8080 29.146.139.51:30005 18.37.240.161:6409 178.62.112.199:8080 59.148.253.194:443 196.44.98.190:8080 79.235.8.209:58224 202.28.34.99:8080 78.46.73.125:443 51.68.141.164:8080 207.148.81.119:8080 93.104.209.107:8080 185.148.168.220:8080 100.21.231.107:63582 103.85.95.4:8080 62.171.178.147:8080 175.126.176.79:8080 134.122.119.23:8080 202.134.4.210:7080 116.124.128.206:8080 45.71.195.104:8080 110.235.83.107:7080 103.56.149.105:8080 68.183.91.111:8080 119.44.217.160:39748 5.56.132.177:8080 195.154.146.35:443 217.182.143.207:443 54.37.106.167:8080 85.214.67.203:8080 90.63.125.244:30283 188.225.32.231:4143 103.42.58.120:7080 139.196.72.155:8080
eck1.plain
eck1.plain

Target

6f42d9158ac6f371098ca9976cb2023ae3826b3a074c7d9f717106f0bcac4bc5

MD5

d4337de652256321b79f131b3ce4c82e

Filesize

362KB

Score

10^/10

SHA1

1960ccbc5269143e53a8d32dd623488db8c630cd

SHA256

6f42d9158ac6f371098ca9976cb2023ae3826b3a074c7d9f717106f0bcac4bc5

SHA512

6c0f6890f1ccdc3373d9b2e60eecb9317d72e27201acd23d0d82c6df3ebf062162085bc4c25cfd39c9d76cbdea4b0d686937e83b4446bee91f67e7022b33b70e

Signatures

Emotet
Description

Emotet is a trojan that is primarily spread through spam emails.
Tags

trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags

suricata

Related Tasks

behavioral1

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

behavioral1

emotet epoch5 banker suricata trojan

10^/10

Extracted

Tags

Signatures

Emotet

Description

Tags

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Description

Tags

Related Tasks

static1

behavioral1