Overview

overview

10

Static

static

10

4f8a0ad5d8...08.exe

windows10-1703-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f8a0ad5d809aefffefa014fb556aa5fbe82ec08.zip

  • Size

    20KB

  • MD5

    456072dc55f47477f58a544cc0680286

  • SHA1

    5441f237d133f601e9b998e1901849cfdb7215c0

  • SHA256

    80ef22f53400f7c50cc971697dd8d3909580c5bd4c2ca6241588fbde4ac03921

  • SHA512

    6fc27c82529ba3803191b401e28cc55ff630caf214dad7c8738640a16fc9cf0d0286da556ba38af0ae57b8231a1f6a01560e944257ea97e3433d213d8d85d4c3

  • SSDEEP

    384:f6oWsdcLtsPh95Fi4yDevNBjxgsQBph3+q3uyem+jAABkJiKjjmaqcQL17:fhWvAme1gsQBv3leyeo+9AjcfLp

Score
10/10
trojanbankerepoch2emotet

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

69.30.203.214:8080

67.205.85.243:8080

79.98.24.39:8080

5.196.74.210:8080

188.83.220.2:443

109.116.214.124:443

203.117.253.142:80

104.131.11.150:443

97.82.79.83:80

121.124.124.40:7080

83.169.36.251:8080

89.186.91.200:443

70.167.215.250:8080

204.197.146.48:80

167.86.90.214:8080

190.160.53.126:80

95.213.236.64:8080

47.144.21.12:443

169.239.182.217:8080
rsa_pubkey.plain

Signatures

  • Emotet family
    emotet
  • Emotet payload 1 IoCs

    Detects Emotet payload in memory.

    trojanbanker

Files

  • 4f8a0ad5d809aefffefa014fb556aa5fbe82ec08.zip
    .zip

    Password: infected

  • 4f8a0ad5d809aefffefa014fb556aa5fbe82ec08.rl
    .exe windows x86

    Password: infected


    Headers

    Sections