Overview

overview

10

Static

static

10

artifact.exe

windows7-x64

3

artifact.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    artifact.bin

  • Size

    48KB

  • MD5

    d6ed9c74a7a0426c5aa7a1e71297f948

  • SHA1

    6ed7c292a367efa3984dca34fcb2a6fdd9a2a5d1

  • SHA256

    ddaf2f537d9990939f13561fd0cacecba82ff33bcab81ab14750b143480d758e

  • SHA512

    6653636658e6cef070dd981aa5d555213679ad1079a4ca101a4dae1c5bcb2f8c5c4acecdcb89604f581755612771a7b999f20e02318f22b21b90d7bc9839902c

  • SSDEEP

    768:ZCwSWJf70j1GEANY56B8Bcw5Mm9VbKIxYhuSgbJeItssFznhtaqNMIfWaArcflJx:kGerYh6NDjmulgmeQGN3fzRZ+Avl

Score
10/10
trojanbankerepoch2emotet

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080
rsa_pubkey.plain

Signatures

  • Emotet family
    emotet
  • Emotet payload 1 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • artifact.bin
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections