Behavioral task
behavioral1
Sample
ae90a26f50161558cba0cc3a4e8e5d58b5cbb25cd73b2e433ec8117206981d9c.exe
Resource
win7-20220718-en
General
-
Target
ae90a26f50161558cba0cc3a4e8e5d58b5cbb25cd73b2e433ec8117206981d9c
-
Size
61KB
-
MD5
b6b3b7ab04cab7927e043a3a1fe795a6
-
SHA1
c7e23a585698078df1dcc734a78044b04541495c
-
SHA256
ae90a26f50161558cba0cc3a4e8e5d58b5cbb25cd73b2e433ec8117206981d9c
-
SHA512
7d851bf0c9503b64525e5294abda713655169cec57cadc282275c1851cdb253d0fc7968551fb2c0c42f9d70efeb3960ff225328a805f94a83045fe0ed641483f
-
SSDEEP
1536:4ABSiu85ZhssK0Xvkv96rksc/cqNcigRSMe+K0irHae0IAiqiHB:nLZhsUXvkF3/cqNdgR2mwB
Malware Config
Extracted
emotet
Epoch3
70.32.94.58:8080
213.138.100.98:8080
144.76.62.10:8080
110.36.234.146:80
51.38.134.203:8080
83.169.33.157:8080
113.52.135.33:7080
93.78.205.196:443
178.249.187.150:7080
216.75.37.196:8080
181.97.70.132:8080
181.47.235.26:993
176.58.93.123:80
80.227.67.18:20
138.197.140.163:8080
190.13.146.47:443
173.249.157.58:8080
192.241.220.183:8080
186.10.16.244:53
181.113.229.139:990
201.196.15.79:990
91.109.5.28:8080
203.99.188.203:990
70.45.30.28:80
203.99.182.135:443
212.112.113.235:80
5.189.148.98:8080
95.216.207.86:7080
94.177.253.126:80
143.95.101.72:8080
216.70.88.55:8080
189.253.27.123:465
125.99.61.162:7080
157.7.164.178:8081
78.109.34.178:443
Signatures
-
Emotet family
Files
-
ae90a26f50161558cba0cc3a4e8e5d58b5cbb25cd73b2e433ec8117206981d9c.exe windows x86
009889c73bd2e55113bf6dfa5f395e0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsProcessorFeaturePresent
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1012B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ