Overview

overview

10

Static

static

1

W00LrSyV20...Fg.dll

windows7-x64

10

W00LrSyV20...Fg.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0adcf412bfc4fcb5d87415738938b3f6.bin

  • Size

    352KB

  • Sample

    230309-bc29hsgg8w

  • MD5

    466d8aabdac4397d7b8f72a201927513

  • SHA1

    5162b305dd010534c382d896e8852ad837e53c20

  • SHA256

    e2a414955a7e21b26db54ce5cdba0e8388ef294d7de5be29ba2f46fa64353bac

  • SHA512

    8cdfdc639e6c720d3163a61abe2df1c05546e4ba0dde016350caf60a67f9579c47647dcfe99625f42faeb0506528d414b5bd5dcb633a8b55d1bda66bae653cca

  • SSDEEP

    6144:w3u6f/63wmOmuZwNAEv+xJaQ7YClOxWEOof1ZrSeoQbDbdCwHLwnW28ONtEd6:w3ue/63wqCXEWxT7puWEpf1ZiQbXWW2t

Score
10/10
emotetepoch4bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443
eck1.plain
ecs1.plain

Targets

    • Target

      W00LrSyV20BPznMiaFg.dll

    • Size

      544.7MB

    • MD5

      b51cf179d0ef3cd33c567cca4f007e6f

    • SHA1

      ff336f4006ce1834996062aa78a2b9f7bac394a7

    • SHA256

      2112b5695e7bbe910a6efbab32332027a7fd6384f54c55c6e61a26812ad47e6d

    • SHA512

      f094830e17045bd622e811f952383e27a64bab602a52f7e9a5707803a15cd59a38f0df6ffc27065c49ca87f8f394afa9f7a53666627c456888fff9cf86e3b03e

    • SSDEEP

      24576:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/mofqkU8jG:boJMjyc3w4WzNps

    Score
    10/10
    emotetepoch4bankertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks