Overview

overview

10

Static

static

10

reswnop.exe

windows7-x64

10

reswnop.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    reswnop.exe

  • Size

    57KB

  • MD5

    d09a466039ffe16e231a202bd6259db8

  • SHA1

    a625728ec40bd353b79913bed4dee0c297467d3d

  • SHA256

    591d32aeae0554f744df8843727e794d33495ff0a4b90a9f7861ab526988ded7

  • SHA512

    fdd7e00f1e08f51610c90df3d75c7228f6567acc6dc3c7c0e04af5ece90a7042dae445c3f80facdbd9150e579dcbc773a23b0e423c68670daae1d7dce220f80a

  • SSDEEP

    1536:pKlUb+Dm4s9hN1YkPDckM8HsquOBcrqqRTVrdnsqiMSKMkS:EI4sZ1YkPH1BcGqFVrBo3

Score
10/10
epoch2emotet

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

201.184.105.242:443

24.45.195.162:7080

24.45.195.162:8443

94.192.225.46:80

80.11.163.139:443

133.167.80.63:7080

198.199.114.69:8080

80.79.23.144:443

192.254.173.31:8080

67.225.229.55:8080

190.108.228.48:990

62.75.187.192:8080

185.94.252.13:443

94.205.247.10:80

211.63.71.72:8080

59.103.164.174:80

192.81.213.192:8080

27.4.80.183:443

190.145.67.134:8090

115.78.95.230:443
rsa_pubkey.plain

Signatures

  • Emotet family
    emotet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • reswnop.exe
    .exe windows:6 windows x86 arch:x86

    009889c73bd2e55113bf6dfa5f395e0d


    Headers

    Imports

    Sections