Overview

overview

10

Static

static

9d6442f0f4...11.exe

windows7-x64

10

9d6442f0f4...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d6442f0f491649643f90a905eea1462a53efe11.exe

  • Size

    536KB

  • Sample

    221130-las8yagb36

  • MD5

    330d6712692ad8010245216761b330f7

  • SHA1

    9d6442f0f491649643f90a905eea1462a53efe11

  • SHA256

    1ad0035a970f4babc4060839210c385bab09fac65651c8d15e1284b95feb7f35

  • SHA512

    8ef2606e93816166fd80def1e06b21c7ad1171fb88778d5fc4e453e4acd6613819fc6874a2ac3cacf89a4347ec26aeeb7af8d3b7dde4f85835e514ddbbd31d42

  • SSDEEP

    12288:TRZT0sMM7KQOSkKF2BQa/3/8TpvBuCLnXX:TRF7dkKEQa/0tF7

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990
rsa_pubkey.plain

Targets

    • Target

      9d6442f0f491649643f90a905eea1462a53efe11.exe

    • Size

      536KB

    • MD5

      330d6712692ad8010245216761b330f7

    • SHA1

      9d6442f0f491649643f90a905eea1462a53efe11

    • SHA256

      1ad0035a970f4babc4060839210c385bab09fac65651c8d15e1284b95feb7f35

    • SHA512

      8ef2606e93816166fd80def1e06b21c7ad1171fb88778d5fc4e453e4acd6613819fc6874a2ac3cacf89a4347ec26aeeb7af8d3b7dde4f85835e514ddbbd31d42

    • SSDEEP

      12288:TRZT0sMM7KQOSkKF2BQa/3/8TpvBuCLnXX:TRF7dkKEQa/0tF7

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks