Overview

overview

10

Static

static

1

VG0srkGsej...6D.dll

windows7-x64

10

VG0srkGsej...6D.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4.zip

  • Size

    311KB

  • Sample

    230321-qqjfwscf2z

  • MD5

    bf2c6bcf08966c1ff7f1f536a3708e34

  • SHA1

    9a3ff1731e7ca6657ce6c1a6a114cdc6c6d83be0

  • SHA256

    d33ce523b48e8b773043cc14d4e7a24475f6e6f33098bcc7490f060f1fc58b46

  • SHA512

    b7e9742794c0840bb49618d4faab48c83dd2421766763dea8c9ee0b81bfd97c343fa019abd06bf02f7199398615c9a49b3fd92c2f323ad205ace044a46d0e67f

  • SSDEEP

    6144:qG9VhcE2y4MaCcasGLcRjq2Mc5sYudSjA3GuYWIRK:RhJ2FMaPtRjq2R5snWKT

Score
10/10
emotetepoch5bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080
ecs1.plain
eck1.plain

Targets

    • Target

      VG0srkGsej8U9u5qMqDbfOH8g68F026D.dll

    • Size

      505.5MB

    • MD5

      b65f280adced3d70e4bb5fc14c57c783

    • SHA1

      336a151eca853bef5fab34acc7f5c5be5bb11313

    • SHA256

      5a8b9be736eb447d3147f48c5d06196b4b937d9eb1627e39c7f780f53ca02030

    • SHA512

      9667f16a7e982941eb228d46098fb2cb39335eff728c17ae8befe2bd7265a2363e45d29800fc1ce0dd2a60e9f0b073df2f4ce1feba7f216260ac7be1b93d24cf

    • SSDEEP

      12288:chQZR06Fy1F5YqSDZ9ma2aCStos1F3uD2Hescq2mc:jT08y1F5YqSDZ9ma21Str3cTX

    Score
    10/10
    emotetepoch5bankertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks