Overview

overview

10

Static

static

69ac6bdf65...2e.exe

windows7-x64

10

69ac6bdf65...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69ac6bdf65e9977b2a2d6748fe738096abf8092e.exe

  • Size

    179KB

  • Sample

    221130-ld8g2abc2s

  • MD5

    26a82e446b65e20481142ed534673f90

  • SHA1

    69ac6bdf65e9977b2a2d6748fe738096abf8092e

  • SHA256

    bd16d173440debec2eb2c8a056584edf4a7a32d2a42bf73b8e4a59f364ec6710

  • SHA512

    45231408733ee66e1c26a70088ade59c73d68daffceac6ee6ff35c0f524c5b80bb1f3ef1c367b96817fb01be85a147ce92fa3daacdfbca9ec75a4e7a36388363

  • SSDEEP

    3072:ieYRRrPEdZRvW7PfLIKSD4sFl62iW67+LPqgwOw0balj955KC:ieOPm+PzIKI4GFih+O4balj9+

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990
rsa_pubkey.plain

Targets

    • Target

      69ac6bdf65e9977b2a2d6748fe738096abf8092e.exe

    • Size

      179KB

    • MD5

      26a82e446b65e20481142ed534673f90

    • SHA1

      69ac6bdf65e9977b2a2d6748fe738096abf8092e

    • SHA256

      bd16d173440debec2eb2c8a056584edf4a7a32d2a42bf73b8e4a59f364ec6710

    • SHA512

      45231408733ee66e1c26a70088ade59c73d68daffceac6ee6ff35c0f524c5b80bb1f3ef1c367b96817fb01be85a147ce92fa3daacdfbca9ec75a4e7a36388363

    • SSDEEP

      3072:ieYRRrPEdZRvW7PfLIKSD4sFl62iW67+LPqgwOw0balj955KC:ieOPm+PzIKI4GFih+O4balj9+

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks