Overview

overview

10

Static

static

6fa0dd6002...90.exe

windows7-x64

10

6fa0dd6002...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90.zip

  • Size

    263KB

  • Sample

    221130-e2scdsah7w

  • MD5

    0475aa97a5d77eaad2ec95e57fd78d07

  • SHA1

    8ffb7ba6c2c99e1248f25788adbf399cf5e9d431

  • SHA256

    d3f35bb0dbb8e100726324ead480797a92c3090664401742359ab9709712c667

  • SHA512

    490481eb25b72b42895eabe6a355b1816cdb0165e2a66be5a3e1da0780fdd5702368ddd03479eb3ce50334961d00cc2441425521e18f9f75c3631432b4179d21

  • SSDEEP

    6144:V7c3sZAiBACh44FdKcx9xTXPj/3dYZ8BqQJ4:V7wAAi/u4XKcx9B7vGZ8BqQa

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990
rsa_pubkey.plain

Targets

    • Target

      6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90.exe

    • Size

      490KB

    • MD5

      f4d1470af3a7d82560b38558b132d468

    • SHA1

      0c45cf4e32116eae8d73b52c140f5d91a19ee8ea

    • SHA256

      6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90

    • SHA512

      1f45093e1509d86ab03ee2c6f15a6dbc3ed4f41cac3c8faf5ae66445b787b58bf9e69d047d7ead3d1d22284d351fbb739a7a7eb73180f746f3d4f621859206c8

    • SSDEEP

      12288:x1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhDG5Fq:x16SbcMMlpLLOS

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks