Overview

overview

10

Static

static

1

VG0srkGsej...6D.dll

windows7-x64

10

VG0srkGsej...6D.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4.zip

  • Size

    311KB

  • Sample

    230321-rznmmsbc29

  • MD5

    b2593e523c2ed34cc9ad326a6a3a7d6e

  • SHA1

    3ace26493d1c1d381f6d715dac7571b7cb27d7b7

  • SHA256

    fcbcb62d0b504f4a8191e0d34e91723db124c70856bf5ed8c75775ff7962e546

  • SHA512

    58227a09565674fdd53490106a14d8bd2f3dacefb01a9be8e12b33f7577edb86b37308dffa5c0b4340779b83fc2fcc618cb14d555307f2fc1ec9e302b2e3bc95

  • SSDEEP

    6144:hADJPEBSwCCIzMPzEhNLg2ErP+Di+t2NtY/QgVqfMiZNgjDprJ6PK4:hADJ8SjCZEhNLir+O+teqMfMGeprv4

Score
10/10
emotetepoch5bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080
ecs1.plain
eck1.plain

Targets

    • Target

      VG0srkGsej8U9u5qMqDbfOH8g68F026D.dll

    • Size

      505.5MB

    • MD5

      b65f280adced3d70e4bb5fc14c57c783

    • SHA1

      336a151eca853bef5fab34acc7f5c5be5bb11313

    • SHA256

      5a8b9be736eb447d3147f48c5d06196b4b937d9eb1627e39c7f780f53ca02030

    • SHA512

      9667f16a7e982941eb228d46098fb2cb39335eff728c17ae8befe2bd7265a2363e45d29800fc1ce0dd2a60e9f0b073df2f4ce1feba7f216260ac7be1b93d24cf

    • SSDEEP

      12288:chQZR06Fy1F5YqSDZ9ma2aCStos1F3uD2Hescq2mc:jT08y1F5YqSDZ9ma21Str3cTX

    Score
    10/10
    emotetepoch5bankertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks