Overview

overview

10

Static

static

61c0153ba8...54.exe

windows7-x64

10

61c0153ba8...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61c0153ba8ce4f5ee6ec250170e444c8d71b9754.exe

  • Size

    340KB

  • Sample

    221130-lc438agd23

  • MD5

    d5211c4a48e39cb9550ab0e78875c2f1

  • SHA1

    61c0153ba8ce4f5ee6ec250170e444c8d71b9754

  • SHA256

    6de788187b9a790f0a378b94f02582e1453d4f77f5ac4c742c7ffc4bef0ea157

  • SHA512

    c48002b70ba8f190cb512759936b00fb4577031c45b5b5f90498d8ec432f1d600e0534a74e7dda7fbe3d9313f523e14c19185c524cef0b8fdc827a57c15d9cd3

  • SSDEEP

    6144:x95bkDpcaVh2bo7cIG0MHCT4f6D5vGzjjC+ztDxiFk3k8T+rWwn7:35WWaVh2boFGgcCD5ezj2wFWk3k8TA

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.4.172.5:443

186.4.172.5:8080

69.164.201.54:8080

162.241.208.52:8080

167.71.10.37:8080

115.78.95.230:443

159.65.25.128:8080

37.157.194.134:443

27.147.163.188:8080

133.167.80.63:7080

212.71.234.16:8080

41.220.119.246:80

181.31.213.158:8080

85.104.59.244:20

200.71.148.138:8080

91.205.215.66:8080

87.230.19.21:8080

86.98.25.30:53

181.143.53.227:21

152.89.236.214:8080
rsa_pubkey.plain

Targets

    • Target

      61c0153ba8ce4f5ee6ec250170e444c8d71b9754.exe

    • Size

      340KB

    • MD5

      d5211c4a48e39cb9550ab0e78875c2f1

    • SHA1

      61c0153ba8ce4f5ee6ec250170e444c8d71b9754

    • SHA256

      6de788187b9a790f0a378b94f02582e1453d4f77f5ac4c742c7ffc4bef0ea157

    • SHA512

      c48002b70ba8f190cb512759936b00fb4577031c45b5b5f90498d8ec432f1d600e0534a74e7dda7fbe3d9313f523e14c19185c524cef0b8fdc827a57c15d9cd3

    • SSDEEP

      6144:x95bkDpcaVh2bo7cIG0MHCT4f6D5vGzjjC+ztDxiFk3k8T+rWwn7:35WWaVh2boFGgcCD5ezj2wFWk3k8TA

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks