Overview

overview

10

Static

static

de6a8b8612...16.exe

windows7-x64

10

de6a8b8612...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de6a8b8612b5236a18eea1a6a8f53e117d046cf2ad95e079a6715af68f8d2216

  • Size

    276KB

  • Sample

    221026-3b14lshhcj

  • MD5

    a88fae72ffe46deacb565bba80179349

  • SHA1

    c6d308e6ef8cd472b50c8679592d79fa20b45d80

  • SHA256

    de6a8b8612b5236a18eea1a6a8f53e117d046cf2ad95e079a6715af68f8d2216

  • SHA512

    e5128ee700ebe2624fb6fcb6504237275ff32950bf2fc3d3bfa1ffc703e265610d10703176b75c77d8c4eb74945bd9e46ca0095427da46e5322b065ef27a4a64

  • SSDEEP

    3072:2xUIvfl2nnKJFddS2TZGjRurmOEfRtaG/70Jfm4JuLYwO9/+Tl:2lvfUnKJFddhAjYrmOEpzcflQu1+

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20
rsa_pubkey.plain

Targets

    • Target

      de6a8b8612b5236a18eea1a6a8f53e117d046cf2ad95e079a6715af68f8d2216

    • Size

      276KB

    • MD5

      a88fae72ffe46deacb565bba80179349

    • SHA1

      c6d308e6ef8cd472b50c8679592d79fa20b45d80

    • SHA256

      de6a8b8612b5236a18eea1a6a8f53e117d046cf2ad95e079a6715af68f8d2216

    • SHA512

      e5128ee700ebe2624fb6fcb6504237275ff32950bf2fc3d3bfa1ffc703e265610d10703176b75c77d8c4eb74945bd9e46ca0095427da46e5322b065ef27a4a64

    • SSDEEP

      3072:2xUIvfl2nnKJFddS2TZGjRurmOEfRtaG/70Jfm4JuLYwO9/+Tl:2lvfUnKJFddhAjYrmOEpzcflQu1+

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks