Overview

overview

10

Static

static

3

a4048f7d23...71.exe

windows10-2004-x64

10

Resubmissions

20-11-2024 21:28

241120-1brttsyken 10

19-04-2024 21:35

240419-1fjn1sgb89 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16760777501.zip

  • Size

    323KB

  • Sample

    241120-1brttsyken

  • MD5

    6c1f0f3feb0931798e790cec094d692a

  • SHA1

    73dd128420e6e5e4e3a16dafd003034a3557577d

  • SHA256

    21355a5158e103290ef5046f3146a4d905d469b6285309ce08301c2129ed0e55

  • SHA512

    d8928aadc226dade005f748b0b932d90b964c85572a2def3a91b9c11ae3490fde694c613ab01e58ad33a7834f6b80d65920a494aa462659c9b95d534b87a06c8

  • SSDEEP

    6144:hnliZk/ek2l4OF2vqwFNJsnMp2ZXY1vzl0fA0Gbfa+Pqd9xr30Cu:1sZi72LLAWMpUXY1aAfvqRz0r

Score
10/10
emotetepoch1bankerdavediscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080
rsa_pubkey.plain

Targets

    • Target

      a4048f7d23b2860f1a26171bf257872cfb03e68100f560a109cffc1ea989fb71

    • Size

      768KB

    • MD5

      7ee4feeded88cb104448141ef375be8c

    • SHA1

      e25f916c0771699d29f84963c3a2f86021c12c1c

    • SHA256

      a4048f7d23b2860f1a26171bf257872cfb03e68100f560a109cffc1ea989fb71

    • SHA512

      93e920ccb88230cc8342dbd3cad0fa8c2bdc8be5ffebbdc0f3a04d74bed8dce2cd8a7467791964f8f1e44d1d0b5ed1f90027618362c52929c71a736e052eea93

    • SSDEEP

      12288:c26abQRZhqJWcWinrZiKwcZV7jljljq7XksXRHg:2abQR2oynr2cVNqTksX

    Score
    10/10
    emotetepoch1bankerdavediscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks