Overview

overview

10

Static

static

a6ba44256f...83.exe

windows7-x64

10

a6ba44256f...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6ba44256f7e4f7ba40e08111c6eee228543de7992a7a941b54ec9dd13415c83

  • Size

    700KB

  • Sample

    221026-3bw5nahhe2

  • MD5

    2400e59477745dac183f8d11c8267ffa

  • SHA1

    6c22eb3c9ea82b12669ba4ad64ebc72886e74f97

  • SHA256

    a6ba44256f7e4f7ba40e08111c6eee228543de7992a7a941b54ec9dd13415c83

  • SHA512

    c6d1788475e373d584a0d6d1f8a64ca469bbf616a373b496d25c04f643825f22eb5351720ad7317866a7fbcb9f88f1000e36c290b825c497a337247bd9883ca2

  • SSDEEP

    12288:DyXMU1e35mT4PfLy0+mS7x+x/v4qcyFuNVNdn:wMV3ATe+0a8xzuXv

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

76.221.133.146:80

104.33.129.244:80

172.90.70.168:8080

96.126.121.64:443

104.236.137.72:8080

172.104.233.225:8080

85.234.143.94:8080

50.28.51.143:8080

190.186.164.23:80

47.146.42.234:80

63.246.252.234:80

80.29.54.20:80

68.183.190.199:8080

46.28.111.142:7080

183.82.97.25:80

87.106.46.107:8080

188.216.24.204:80

186.68.48.204:443

181.198.203.45:443

88.250.223.190:8080
rsa_pubkey.plain

Targets

    • Target

      a6ba44256f7e4f7ba40e08111c6eee228543de7992a7a941b54ec9dd13415c83

    • Size

      700KB

    • MD5

      2400e59477745dac183f8d11c8267ffa

    • SHA1

      6c22eb3c9ea82b12669ba4ad64ebc72886e74f97

    • SHA256

      a6ba44256f7e4f7ba40e08111c6eee228543de7992a7a941b54ec9dd13415c83

    • SHA512

      c6d1788475e373d584a0d6d1f8a64ca469bbf616a373b496d25c04f643825f22eb5351720ad7317866a7fbcb9f88f1000e36c290b825c497a337247bd9883ca2

    • SSDEEP

      12288:DyXMU1e35mT4PfLy0+mS7x+x/v4qcyFuNVNdn:wMV3ATe+0a8xzuXv

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks