Overview

overview

10

Static

static

10

0864575d4f...a0.dll

windows7-x64

3

0864575d4f...a0.dll

windows10-2004-x64

3

933511776c...82.dll

windows7-x64

10

933511776c...82.dll

windows10-2004-x64

10

62bc8624b6...18.exe

windows7-x64

10

62bc8624b6...18.exe

windows10-2004-x64

10

bea9fc6693...3a.exe

windows7-x64

10

bea9fc6693...3a.exe

windows10-2004-x64

10

emotet_exe...44.dll

windows7-x64

10

emotet_exe...44.dll

windows10-2004-x64

10

3ec811757a...e9.exe

windows7-x64

10

3ec811757a...e9.exe

windows10-2004-x64

10

57800373ef...15.dll

windows7-x64

3

57800373ef...15.dll

windows10-2004-x64

3

61a47ebee9...f9.dll

windows7-x64

10

61a47ebee9...f9.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    975ec4a6250960b45606ce9c155560c3283a3df4ffab69ec81f8cabdbc714b0e

  • Size

    7.0MB

  • MD5

    5d38df343650fc8ffb48fd7b2d9ab480

  • SHA1

    6dc3380f3952d06e446a10819a17196366221f1c

  • SHA256

    975ec4a6250960b45606ce9c155560c3283a3df4ffab69ec81f8cabdbc714b0e

  • SHA512

    202f2e6920d09c946408ac19922797a8cebda81417d82b5085a2d5be17b857d215d8ab29bbee4619c18657242f75059796cc4f59c07f07fd145ea722867a8acf

  • SSDEEP

    196608:MSm1UwXO5KKD++70lt0qpFalPd1ULrE+B8hBEAYJJn6UOmp:y1U5KKD+jjRpFMArE+ByErJJn6UO6

Score
10/10
epoch2agentteslaemotet

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

emotet

C2

5.189.160.61:443

94.177.178.26:8080

202.29.239.162:443

54.38.143.246:7080

119.59.125.140:8080

185.148.168.15:8080

188.166.229.148:443

2.58.16.87:8080

104.131.62.48:8080

103.82.248.59:7080

37.59.209.141:8080

103.133.214.242:8080

195.77.239.39:8080

128.199.192.135:8080

78.47.204.80:443

59.148.253.194:443

87.106.97.83:7080

45.71.195.104:8080

85.214.67.203:8080

139.196.72.155:8080

Extracted

Family

emotet

Botnet

Epoch2

C2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80
rsa_pubkey.plain

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
    agenttesla
  • Emotet family
    emotet
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 975ec4a6250960b45606ce9c155560c3283a3df4ffab69ec81f8cabdbc714b0e
    .zip
  • 0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0.zip
    .zip

    Password: infected

  • 0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0.dll
    .dll windows:5 windows x86 arch:x86

    cd8ebea09892dc08987d62be19403754


    Headers

    Imports

    Exports

    Sections

  • 220112-dmhzqsbabn_pw_infected.zip
    .zip

    Password: infected

  • 933511776c5c34172b315807d11ecdd0c802f94492cace5c7127d1ddf47b2c82
    .dll regsvr32 windows:5 windows x86 arch:x86

    d986dd84d593c1266f1531c47644f308


    Headers

    Imports

    Exports

    Sections

  • 220113-lamfdshaa9_pw_infected.zip
    .zip

    Password: infected

  • 62bc8624b6ed645ddbe1420ca67376863c88e58e347fc8282001a2b9e3330918
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 220116-bncs1afbc6_pw_infected.zip
    .zip

    Password: infected

  • bea9fc669319cd16df759974397e79c05e7565e75ca7c052af346e08b5f1d13a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 220419-abax7sdffq_pw_infected.zip
    .zip

    Password: infected

  • emotet_exe_e5_53d5a86b1cb032154775e725ed728ba4bd819d40f3a541744661fcbd4d702319_2022-04-19__000144._exe
    .dll regsvr32 windows:4 windows x86 arch:x86

    0e8a17377c9b4601e7a0971e33ed66d1


    Headers

    Imports

    Exports

    Sections

  • 3ec811757abece5eeb8d73fce8770390b5714b16e075c2558de050205cd8c8e9.zip
    .zip

    Password: infected

  • 3ec811757abece5eeb8d73fce8770390b5714b16e075c2558de050205cd8c8e9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 44706c08266d280e6676bc6ebf3c13b20ebd16de2c5cf15d8be020d0d0d74fbe.rar
    .rar
  • 57800373ef6281de3f09ea995703c2307c548717622244573a76e843a9c7b115.zip
    .zip

    Password: infected

  • 57800373ef6281de3f09ea995703c2307c548717622244573a76e843a9c7b115
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections

  • 61a47ebee921db8a16a8f070edcb86b5efd47a8d185bf4691b57e76f697981f9.bin.zip
    .zip

    Password: infected

  • 61a47ebee921db8a16a8f070edcb86b5efd47a8d185bf4691b57e76f697981f9.bin
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Caff54e1.bin.zip
    .zip
  • QUOTATION REQUEST-77464563548764577.bin.zip
    .zip
  • SecuriteInfo.com.W32.MSIL_Kryptik.GIP.genEldorado.24848.27027.zip
    .zip
  • _____WGA45-J20.exe.zip
    .zip
  • a.js.zip
    .zip
  • dbS6VfB.bin.zip
    .zip
  • maxhkjfd768.bin.zip
    .zip
  • qakbot,vir.zip
    .zip
  • wi8cp0.bin.zip
    .zip