Overview

overview

10

Static

static

10

47dba610a0...0d.exe

windows7-x64

10

47dba610a0...0d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47dba610a04ef1d7f18a795108cf9e62d2d6e9e22f0fba51143462f4d569a70d

  • Size

    65KB

  • Sample

    230610-sbbtlsfh4z

  • MD5

    176b6e4649ccebe0f73d40146d0b7fa1

  • SHA1

    4941b675ed6aae118932f8ced2b1db3f52a6eab3

  • SHA256

    47dba610a04ef1d7f18a795108cf9e62d2d6e9e22f0fba51143462f4d569a70d

  • SHA512

    ac1b8b695c9c0b3afebf4b7277b638b1317399c2dc910b2cd26ae9e548dc684974ede9f3e14268dfda3ce901ee23ac74663a06386e403a652cca070ed557f78a

  • SSDEEP

    1536:1E1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+w:mLjsXANkR/fkfdWolI9AiDZ

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.188.166.192:80

42.190.4.92:443

170.130.31.177:8080

51.255.165.160:8080

45.56.79.249:443

60.52.64.122:80

190.182.161.7:8080

86.42.166.147:80

91.83.93.124:7080

186.1.41.111:443

51.15.8.192:8080

104.131.58.132:8080

142.93.114.137:8080

201.213.32.59:80

163.172.40.218:7080

190.230.60.129:80

87.106.77.40:7080

190.230.60.129:8080

190.79.228.89:443

178.249.187.151:8080
rsa_pubkey.plain

Targets

    • Target

      47dba610a04ef1d7f18a795108cf9e62d2d6e9e22f0fba51143462f4d569a70d

    • Size

      65KB

    • MD5

      176b6e4649ccebe0f73d40146d0b7fa1

    • SHA1

      4941b675ed6aae118932f8ced2b1db3f52a6eab3

    • SHA256

      47dba610a04ef1d7f18a795108cf9e62d2d6e9e22f0fba51143462f4d569a70d

    • SHA512

      ac1b8b695c9c0b3afebf4b7277b638b1317399c2dc910b2cd26ae9e548dc684974ede9f3e14268dfda3ce901ee23ac74663a06386e403a652cca070ed557f78a

    • SSDEEP

      1536:1E1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+w:mLjsXANkR/fkfdWolI9AiDZ

    Score
    10/10
    emotetbankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks