Overview

overview

10

Static

static

51992faf6a...dd.exe

windows7-x64

10

51992faf6a...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51992faf6a2da6e340b65ee42b2a33ccc77306331152b6c5a7516bcde129c8dd

  • Size

    172KB

  • Sample

    230129-wz7sqsab9y

  • MD5

    6c2ab8daa4208f072733a6fd4c327a81

  • SHA1

    2c26b34e44b524297f4df23b5e15612b5bfc7ba2

  • SHA256

    51992faf6a2da6e340b65ee42b2a33ccc77306331152b6c5a7516bcde129c8dd

  • SHA512

    b0731e2f9b24953058ddd8ce5ead6006b525f91369f2bdd6599408cd86c0cfbfdf9a8df957f048b8669f63514ceeda1cc66222497f46a131869168da776cfea4

  • SSDEEP

    3072:+2nTLLEpyrQqMEh7fnt8V7TDvd8FT7QFhfxbXxgCzXt3O:+2nTLUyrQBENt8Vf58FTYXxZzZO

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

81.109.227.123:80

82.15.36.209:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

178.152.78.149:20

104.131.208.175:8080

136.243.177.26:8080

206.189.98.125:8080

178.79.161.166:443

195.242.117.231:8080

187.163.222.244:465

186.144.64.31:53

104.236.99.225:8080

71.244.60.230:8080

91.205.215.66:8080

212.71.234.16:8080

190.25.255.98:443
rsa_pubkey.plain

Targets

    • Target

      51992faf6a2da6e340b65ee42b2a33ccc77306331152b6c5a7516bcde129c8dd

    • Size

      172KB

    • MD5

      6c2ab8daa4208f072733a6fd4c327a81

    • SHA1

      2c26b34e44b524297f4df23b5e15612b5bfc7ba2

    • SHA256

      51992faf6a2da6e340b65ee42b2a33ccc77306331152b6c5a7516bcde129c8dd

    • SHA512

      b0731e2f9b24953058ddd8ce5ead6006b525f91369f2bdd6599408cd86c0cfbfdf9a8df957f048b8669f63514ceeda1cc66222497f46a131869168da776cfea4

    • SSDEEP

      3072:+2nTLLEpyrQqMEh7fnt8V7TDvd8FT7QFhfxbXxgCzXt3O:+2nTLUyrQBENt8Vf58FTYXxZzZO

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks