Overview

overview

10

Static

static

4380044a95...71.exe

windows7-x64

10

4380044a95...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4380044a9517a08514459005836c5f92e4a33871

  • Size

    100KB

  • Sample

    230201-fwgt5sdh2v

  • MD5

    4be92b527a3b5c3eb053488da12172e6

  • SHA1

    4380044a9517a08514459005836c5f92e4a33871

  • SHA256

    6d7bde30d3fa54e0d14933961e0a8adedd34010200d8d081de23d8623dee3814

  • SHA512

    db394e13e281e7997699f0ec21f8f896afec9415a728b20f21de8cb8dc06cecaf771b3544386e3e953f80a1851b4529d0c51b88964270be42137ed3588b86836

  • SSDEEP

    1536:FEHrMiB/HftZsPM385IMHaK7k4ZK2dVmE81J6fcAJvz1H95zWttEwklaxiFf+Q:Gr/APM3Y7RhdVmEw9AJb1H2bETKi9

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.117.206.153:443

179.62.18.56:443

123.168.4.66:22

178.249.187.151:8080

217.199.160.224:8080

62.75.150.240:7080

71.244.60.230:7080

119.59.124.163:8080

211.229.116.97:80

190.38.14.52:80

217.113.27.158:443

203.25.159.3:8080

190.19.42.131:80

187.188.166.192:80

51.15.8.192:8080

23.92.22.225:7080

189.166.68.89:443

88.250.223.190:8080

189.129.4.186:80

86.42.166.147:80
rsa_pubkey.plain

Targets

    • Target

      4380044a9517a08514459005836c5f92e4a33871

    • Size

      100KB

    • MD5

      4be92b527a3b5c3eb053488da12172e6

    • SHA1

      4380044a9517a08514459005836c5f92e4a33871

    • SHA256

      6d7bde30d3fa54e0d14933961e0a8adedd34010200d8d081de23d8623dee3814

    • SHA512

      db394e13e281e7997699f0ec21f8f896afec9415a728b20f21de8cb8dc06cecaf771b3544386e3e953f80a1851b4529d0c51b88964270be42137ed3588b86836

    • SSDEEP

      1536:FEHrMiB/HftZsPM385IMHaK7k4ZK2dVmE81J6fcAJvz1H95zWttEwklaxiFf+Q:Gr/APM3Y7RhdVmEw9AJb1H2bETKi9

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks