emotet | e8416ac868b6c18b22fe490ad324de3d2d10dc2950b2b9febe017a7150a08684[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e8416ac868b6c18b22fe490ad324de3d2d10dc2950b2b9febe017a7150a08684.bin
Size

64KB
MD5

48b37888bb5c6c9269f7da45814393a5
SHA1

098e2f6eb8e474293d00e84f7c40258818c1a099
SHA256

e8416ac868b6c18b22fe490ad324de3d2d10dc2950b2b9febe017a7150a08684
SHA512

d4143f018e329734d11221b8da4a3932c9b2675ac755056f7270ea2fc0304d6b4fe7b045d025513aed372cf53030250958ad89a83c92ae1df360d34e48f7e395
SSDEEP

768:7X1fFFbd2H1A5Y20N5L2TMqg5TZfuvZyx7A8xlnEJxoFw0ctLTRSg30:7X1fFFbQcYNWvSA8fnGxWw0c6

Score

10^/10

trojan banker emotet

Malware Config

Signatures

Emotet family
emotet

Emotet payload 1 IoCs

Detects Emotet payload in memory.

resource	yara_rule
sample	emotet

Files

e8416ac868b6c18b22fe490ad324de3d2d10dc2950b2b9febe017a7150a08684.bin
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ