Overview

overview

10

Static

static

3

00237cbe87...a7.exe

windows7-x64

10

00237cbe87...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00237cbe87352f3f6343636076255548952ceaded1e80d9ae10dbe7ba134cfa7

  • Size

    308KB

  • Sample

    230522-t7bddsbd79

  • MD5

    322cdccdec1951015f2b39bc386cc21e

  • SHA1

    87af20d1defc1fc3ba66eaeb7691f7f542ee1fc5

  • SHA256

    00237cbe87352f3f6343636076255548952ceaded1e80d9ae10dbe7ba134cfa7

  • SHA512

    449bcbc1f390b223c0e649990738a26d3aa76eabea77bf7ed17f18c222ec2a3f89dd6c3b229bbd56087f92447119d77614bdf8290152dde2635354ffc2206f62

  • SSDEEP

    6144:W3mm/BjL5ovbezHnYN+ygeS2XIM0mvLpEN6VofW8M:am+BjFybezHn52XIMxaEofWb

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

76.87.58.38:80

154.73.137.131:80

181.39.96.86:443

198.58.112.7:443

143.95.101.72:8080

91.205.173.150:8080

124.150.175.133:80

89.215.225.15:80

190.171.153.139:80

78.189.60.109:443

82.165.15.188:8080

23.253.207.142:8080

187.177.155.123:990

83.156.88.159:80

60.130.173.117:80

125.209.114.182:443

216.75.37.196:8080

210.171.146.118:80

162.144.46.90:8080

82.79.244.92:80
rsa_pubkey.plain

Targets

    • Target

      00237cbe87352f3f6343636076255548952ceaded1e80d9ae10dbe7ba134cfa7

    • Size

      308KB

    • MD5

      322cdccdec1951015f2b39bc386cc21e

    • SHA1

      87af20d1defc1fc3ba66eaeb7691f7f542ee1fc5

    • SHA256

      00237cbe87352f3f6343636076255548952ceaded1e80d9ae10dbe7ba134cfa7

    • SHA512

      449bcbc1f390b223c0e649990738a26d3aa76eabea77bf7ed17f18c222ec2a3f89dd6c3b229bbd56087f92447119d77614bdf8290152dde2635354ffc2206f62

    • SSDEEP

      6144:W3mm/BjL5ovbezHnYN+ygeS2XIM0mvLpEN6VofW8M:am+BjFybezHn52XIMxaEofWb

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks