Overview

overview

10

Static

static

3aa21ecf0d...3e.exe

windows7-x64

10

3aa21ecf0d...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e

  • Size

    113KB

  • Sample

    230129-wb28cahc71

  • MD5

    51745a9cf568638991d74644a0e104d2

  • SHA1

    91467044f6e59db3b52852349fc669023b8ae986

  • SHA256

    3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e

  • SHA512

    3140bc473191deb590e5d3a394c9cc2ec6ebe6b2d9e8ae0a6dc2c1c6cd034a8d7bc171030724dce5c0d1a82159234f757d1f6465c83119bf8077689f5334f459

  • SSDEEP

    3072:SXal9qoo7GTJrl+3oZ1mA0rk9pM84WGwKFeE2v8rg:igX5FzpPvK4E2z

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

81.109.227.123:80

82.15.36.209:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

178.152.78.149:20

104.131.208.175:8080

136.243.177.26:8080

206.189.98.125:8080

178.79.161.166:443

195.242.117.231:8080

187.163.222.244:465

186.144.64.31:53

104.236.99.225:8080

71.244.60.230:8080

91.205.215.66:8080

212.71.234.16:8080

190.25.255.98:443
rsa_pubkey.plain

Targets

    • Target

      3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e

    • Size

      113KB

    • MD5

      51745a9cf568638991d74644a0e104d2

    • SHA1

      91467044f6e59db3b52852349fc669023b8ae986

    • SHA256

      3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e

    • SHA512

      3140bc473191deb590e5d3a394c9cc2ec6ebe6b2d9e8ae0a6dc2c1c6cd034a8d7bc171030724dce5c0d1a82159234f757d1f6465c83119bf8077689f5334f459

    • SSDEEP

      3072:SXal9qoo7GTJrl+3oZ1mA0rk9pM84WGwKFeE2v8rg:igX5FzpPvK4E2z

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks