Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

UU3444499999999AA.lnk

windows7-x64

3

UU3444499999999AA.lnk

windows10-2004-x64

10

Resubmissions

06/09/2022, 13:38

220906-qxnn7adff7 10

14/06/2022, 07:29

220614-jbbdeacfdk 10

13/06/2022, 22:26

220613-2cyjfafdb8 10

13/06/2022, 20:59

220613-zstjbaagap 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UU3444499999999AA.lnk

  • Size

    3KB

  • Sample

    220906-qxnn7adff7

  • MD5

    08205fbc8d439bb4dbded1b3b4146daa

  • SHA1

    f07b89b0bb7691406f109e6be7d59551efa91fc7

  • SHA256

    3e3b827cf8b350d18fc92feb1c7bafd89ca2239eb903bef27bdc06a41de98b57

  • SHA512

    c1045c4ab9ce5e3fe0b2c13521b75e824b1501c626782aad55a20923d88ecdc9c0f28fd0b6f005dc5ea69b8af50bd7bb5963f389da55a4e7fc74fa8defbbc902

Score
10/10
emotetepoch4bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

149.56.131.28:8080

72.15.201.15:8080

207.148.79.14:8080

82.165.152.127:8080

46.55.222.11:443

213.241.20.155:443

163.44.196.120:8080

51.254.140.238:7080

107.170.39.149:8080

188.44.20.25:443

82.223.21.224:8080

172.104.251.154:8080

164.68.99.3:8080

101.50.0.91:8080

129.232.188.93:443

173.212.193.249:8080

103.132.242.26:8080

186.194.240.217:443

37.187.115.122:8080

91.207.28.33:8080
eck1.plain
ecs1.plain

Targets

    • Target

      UU3444499999999AA.lnk

    • Size

      3KB

    • MD5

      08205fbc8d439bb4dbded1b3b4146daa

    • SHA1

      f07b89b0bb7691406f109e6be7d59551efa91fc7

    • SHA256

      3e3b827cf8b350d18fc92feb1c7bafd89ca2239eb903bef27bdc06a41de98b57

    • SHA512

      c1045c4ab9ce5e3fe0b2c13521b75e824b1501c626782aad55a20923d88ecdc9c0f28fd0b6f005dc5ea69b8af50bd7bb5963f389da55a4e7fc74fa8defbbc902

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks