Overview

overview

10

Static

static

3

2024-02-12...id.exe

windows7-x64

10

2024-02-12...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-02-12_50786105c5c5eb0c7f0252bc62381146_icedid

  • Size

    468KB

  • Sample

    240212-z8sa7aea77

  • MD5

    50786105c5c5eb0c7f0252bc62381146

  • SHA1

    56d806615b1a8a35aaa6d811fba44dde724912ce

  • SHA256

    518e248794388803c92fd82723eddb854ce07654097557d39cbe98684450fcc1

  • SHA512

    03485c8250ab0942fa36be4d84d7f0eb85410bdce3b9ba1fc76d42b2e489ec0f2698473fcd01d715c594388c51e14b094b054da31a83936fee4d09a7dffcdf35

  • SSDEEP

    6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZRfiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZR1SR

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.91.208.86:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

107.5.122.110:80

103.86.49.11:8080

85.105.205.77:8080

120.150.60.189:80

137.59.187.107:8080

139.59.60.244:8080

203.117.253.142:80

1.221.254.82:80

97.82.79.83:80

37.187.72.193:8080

139.99.158.11:443

152.168.248.128:443

74.208.45.104:8080

83.169.36.251:8080

169.239.182.217:8080

216.208.76.186:80
rsa_pubkey.plain

Targets

    • Target

      2024-02-12_50786105c5c5eb0c7f0252bc62381146_icedid

    • Size

      468KB

    • MD5

      50786105c5c5eb0c7f0252bc62381146

    • SHA1

      56d806615b1a8a35aaa6d811fba44dde724912ce

    • SHA256

      518e248794388803c92fd82723eddb854ce07654097557d39cbe98684450fcc1

    • SHA512

      03485c8250ab0942fa36be4d84d7f0eb85410bdce3b9ba1fc76d42b2e489ec0f2698473fcd01d715c594388c51e14b094b054da31a83936fee4d09a7dffcdf35

    • SSDEEP

      6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZRfiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZR1SR

    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks