Overview

overview

10

Static

static

3

ExeFile (156).exe

windows7-x64

10

ExeFile (156).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ExeFile (156).exe

  • Size

    448KB

  • Sample

    240820-rgqpaazcrr

  • MD5

    c3655ee9fec9873bb87ade937095fed9

  • SHA1

    d15a23b026aa44ea2f5ac3f05203607cb5706e64

  • SHA256

    bb0d9cf3c9e7c28009e20d9c644cb0f687d9fb9f419b3d8fe9c4ab9520fc2247

  • SHA512

    fc94df380ef3bd85f4dc924f8223e2503c60a75aaf84978489816dc6f00ac5045a086b9393d0fe02acc7f882a358ca8146597fccd4a0b20b147a11fc3fdebee4

  • SSDEEP

    12288:LfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxMrBO:LbMmO4sl9sR2Otq

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

75.139.38.211:80

69.30.203.214:8080

67.205.85.243:8080

190.160.53.126:80

183.101.175.193:80

137.59.187.107:8080

168.235.67.138:7080

209.143.35.232:80

180.92.239.110:8080

167.86.90.214:8080

85.66.181.138:80

95.213.236.64:8080

83.169.36.251:8080

157.245.99.39:8080

79.98.24.39:8080

70.167.215.250:8080

93.51.50.171:8080

174.102.48.180:80

24.179.13.119:80

41.60.200.34:80
rsa_pubkey.plain

Targets

    • Target

      ExeFile (156).exe

    • Size

      448KB

    • MD5

      c3655ee9fec9873bb87ade937095fed9

    • SHA1

      d15a23b026aa44ea2f5ac3f05203607cb5706e64

    • SHA256

      bb0d9cf3c9e7c28009e20d9c644cb0f687d9fb9f419b3d8fe9c4ab9520fc2247

    • SHA512

      fc94df380ef3bd85f4dc924f8223e2503c60a75aaf84978489816dc6f00ac5045a086b9393d0fe02acc7f882a358ca8146597fccd4a0b20b147a11fc3fdebee4

    • SSDEEP

      12288:LfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxMrBO:LbMmO4sl9sR2Otq

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks