Overview

overview

10

Static

static

831f9044ab...91.exe

windows7-x64

10

831f9044ab...91.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    831f9044abbfb39c41901ce3e51b0838af8f55ef562f7511ee345bd93fec0c91

  • Size

    113KB

  • Sample

    230129-wb2ltafh49

  • MD5

    8385e91a0a89f0431ccf04453dcd903d

  • SHA1

    0b11627f1d947e253611dff68d093bfba6af4528

  • SHA256

    831f9044abbfb39c41901ce3e51b0838af8f55ef562f7511ee345bd93fec0c91

  • SHA512

    22cdc7bdb30827ddf28fc5eb61b38064ed408647d677a0021c5f713466bc795a6fd172c72fe4842b45bd79aed126f59f43df1f2d004945122bba54dc14a111ff

  • SSDEEP

    3072:OXal9qoo7GTJrl+3oZ1mA0rk9pM84WGwKFeE2v8r8:ugX5FzpPvK4E27

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

81.109.227.123:80

82.15.36.209:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

178.152.78.149:20

104.131.208.175:8080

136.243.177.26:8080

206.189.98.125:8080

178.79.161.166:443

195.242.117.231:8080

187.163.222.244:465

186.144.64.31:53

104.236.99.225:8080

71.244.60.230:8080

91.205.215.66:8080

212.71.234.16:8080

190.25.255.98:443
rsa_pubkey.plain

Targets

    • Target

      831f9044abbfb39c41901ce3e51b0838af8f55ef562f7511ee345bd93fec0c91

    • Size

      113KB

    • MD5

      8385e91a0a89f0431ccf04453dcd903d

    • SHA1

      0b11627f1d947e253611dff68d093bfba6af4528

    • SHA256

      831f9044abbfb39c41901ce3e51b0838af8f55ef562f7511ee345bd93fec0c91

    • SHA512

      22cdc7bdb30827ddf28fc5eb61b38064ed408647d677a0021c5f713466bc795a6fd172c72fe4842b45bd79aed126f59f43df1f2d004945122bba54dc14a111ff

    • SSDEEP

      3072:OXal9qoo7GTJrl+3oZ1mA0rk9pM84WGwKFeE2v8r8:ugX5FzpPvK4E27

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks