Overview

overview

10

Static

static

9

55a80b03ee...af.exe

windows7-x64

10

55a80b03ee...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55a80b03ee90e27367da501b1c944d33bbaa8d602a02ea827aca646a40381eaf

  • Size

    474KB

  • Sample

    221130-txchpsfe52

  • MD5

    1caf518700f8a969fe59ea7c35d13995

  • SHA1

    7f6133ad68ba50920d5d353d346ec7ee7393b883

  • SHA256

    55a80b03ee90e27367da501b1c944d33bbaa8d602a02ea827aca646a40381eaf

  • SHA512

    f6e3e6c93a3afe7b8ce2b8b84e71c61527795728c8ab7121bc875d1731b9b4f97f56defcdba6109fcbc7d353dc4a555f87a42a75944242e79941144614e84bf5

  • SSDEEP

    6144:ieFrEMus74tW3HvPgADDnz/HXnr/vYitorLFDPMTJYhr64Fg0:ntEMus70imrLFPMdV4Fg0

Score
10/10
emotetepoch3bankercryptonepackertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

110.36.234.146:80

197.211.244.6:443

125.99.61.162:7080

115.88.70.226:7080

162.241.232.82:8080

194.50.163.106:8080

162.214.27.219:7080

203.150.19.63:443

179.62.18.56:443

93.78.205.196:443

176.58.93.123:80

138.197.140.163:8080

181.113.229.139:990

201.244.125.210:995

186.10.16.244:53

83.169.33.157:8080

45.33.1.161:8080

186.117.174.26:80

186.93.167.147:443

148.240.52.172:80
rsa_pubkey.plain

Targets

    • Target

      55a80b03ee90e27367da501b1c944d33bbaa8d602a02ea827aca646a40381eaf

    • Size

      474KB

    • MD5

      1caf518700f8a969fe59ea7c35d13995

    • SHA1

      7f6133ad68ba50920d5d353d346ec7ee7393b883

    • SHA256

      55a80b03ee90e27367da501b1c944d33bbaa8d602a02ea827aca646a40381eaf

    • SHA512

      f6e3e6c93a3afe7b8ce2b8b84e71c61527795728c8ab7121bc875d1731b9b4f97f56defcdba6109fcbc7d353dc4a555f87a42a75944242e79941144614e84bf5

    • SSDEEP

      6144:ieFrEMus74tW3HvPgADDnz/HXnr/vYitorLFDPMTJYhr64Fg0:ntEMus70imrLFPMdV4Fg0

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks