Overview

overview

10

Static

static

1

W00LrSyV20...Fg.dll

windows7-x64

10

W00LrSyV20...Fg.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip

  • Size

    352KB

  • Sample

    230308-mfvjmafd67

  • MD5

    45d3dad95ca411f61f4af955c286cba3

  • SHA1

    110d12292ebf70152ebd2770cad7a16c18963411

  • SHA256

    bd1f6c94b97c7cefb0d872ba5b3a92ef93f31b7ce65ba4ee2bf10f8a155ac2e4

  • SHA512

    8dcd895bb427f932043149a24c8b5179da1bcc8f10fcbd49d6939750eb2be92727a1374ae40c9d34b200f531703f2ef88499a9200dfaf24826ce8d238becf877

  • SSDEEP

    6144:yD9iIuNs4Hdm3JxGoW2yH/vwSO2K2+KwusBm5C2Z6p3Ikg0V2vl9+TyL5H6H5UtE:YUXeVJhyH1OKwuLgp3IkgcUvpNa+Ht4

Score
10/10
emotetepoch4bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443
eck1.plain
ecs1.plain

Targets

    • Target

      W00LrSyV20BPznMiaFg.dll

    • Size

      544.7MB

    • MD5

      b51cf179d0ef3cd33c567cca4f007e6f

    • SHA1

      ff336f4006ce1834996062aa78a2b9f7bac394a7

    • SHA256

      2112b5695e7bbe910a6efbab32332027a7fd6384f54c55c6e61a26812ad47e6d

    • SHA512

      f094830e17045bd622e811f952383e27a64bab602a52f7e9a5707803a15cd59a38f0df6ffc27065c49ca87f8f394afa9f7a53666627c456888fff9cf86e3b03e

    • SSDEEP

      24576:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/mofqkU8jG:boJMjyc3w4WzNps

    Score
    10/10
    emotetepoch4bankertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks