Overview

overview

10

Static

static

1

W00LrSyV20...Fg.dll

windows7-x64

10

W00LrSyV20...Fg.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip

  • Size

    352KB

  • Sample

    230308-necsvsfc8y

  • MD5

    54b1995f139d94f46778b1dd7b4818b2

  • SHA1

    8e31603065b7a5555be41d0a99dadef34d7190bc

  • SHA256

    84b0ad29eadddc39e50b56c407d86ee2b3b63b50d2ed1d736c8d3d37e6af1516

  • SHA512

    53f829c4903f279b2d6935fbc8cf7cca9351f0b46f7e3017a641f8e96b5ac8da71ec5b005b25f37c24a15462823a7ffe8d2ad0a46b3b85e0e1f010a3af180c97

  • SSDEEP

    6144:rNa2ib7vjdvlSagrw3xAw3/7RvG3Yqk4p8MvbHBHEWfpbSMsTJ8C0:rXifJdSaww3uwRG3Y0ppvNtpbRsTk

Score
10/10
emotetepoch4bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443
eck1.plain
ecs1.plain

Targets

    • Target

      W00LrSyV20BPznMiaFg.dll

    • Size

      544.7MB

    • MD5

      b51cf179d0ef3cd33c567cca4f007e6f

    • SHA1

      ff336f4006ce1834996062aa78a2b9f7bac394a7

    • SHA256

      2112b5695e7bbe910a6efbab32332027a7fd6384f54c55c6e61a26812ad47e6d

    • SHA512

      f094830e17045bd622e811f952383e27a64bab602a52f7e9a5707803a15cd59a38f0df6ffc27065c49ca87f8f394afa9f7a53666627c456888fff9cf86e3b03e

    • SSDEEP

      24576:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/mofqkU8jG:boJMjyc3w4WzNps

    Score
    10/10
    emotetepoch4bankertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks