Overview

overview

10

Static

static

3

006edfaf4d...e1.dll

windows7-x64

10

006edfaf4d...e1.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fbba40aca580b794584b0d8ea847365860c80953b076a4cc12efe28ff960c13

  • Size

    483KB

  • Sample

    241120-3ynf2awcjd

  • MD5

    43043279f7c4ca002544353ec1b7cc21

  • SHA1

    eba81406ba991451f1ba35355ed312fc4e1da992

  • SHA256

    0fbba40aca580b794584b0d8ea847365860c80953b076a4cc12efe28ff960c13

  • SHA512

    0f8793efcb1cc1191c099d759380460395c0fb6cb2aa19f527dc048392f80c0f847a0d6dc4b8f83f30399258315c5341ebe0c09f59db6a85c26427b361de3db1

  • SSDEEP

    12288:2gf29cTBC3dcYxMk7GxDVp2oXADqyTQL7NFMDl:dVNYnGxDVpSDqy0BCDl

Score
10/10
emotetepoch4bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

169.197.131.16:8080

195.154.253.60:8080

152.89.239.34:443

216.158.226.206:443

159.65.88.10:8080

209.126.98.206:8080

158.69.222.101:443

173.212.193.249:8080

185.157.82.211:8080

81.0.236.90:443

103.75.201.2:443

46.55.222.11:443

159.8.59.82:8080

207.38.84.195:8080

50.116.54.215:443

79.172.212.216:8080

212.237.17.99:8080

212.24.98.99:8080

178.79.147.66:8080

51.254.140.238:7080
eck1.plain
ecs1.plain

Targets

    • Target

      006edfaf4d9dd00e34e38fe7c479549fc3ac75602d4d6e6bb1269a0e15fd6be1

    • Size

      1024KB

    • MD5

      2b2e922f5c724d60c140b5b1ed082f74

    • SHA1

      3325faddcc6bb5c1ca7c79c8239f68e0da3afe91

    • SHA256

      006edfaf4d9dd00e34e38fe7c479549fc3ac75602d4d6e6bb1269a0e15fd6be1

    • SHA512

      d9226ef462065e20efee4d0408986b31cac755977b485f562e67eb2150f36f087851e7e2eaa1f42daf904d6a31eb72a679d197a3f60f271d26432db5f14bb798

    • SSDEEP

      12288:lVHxC/pAfc4onhlKVXlcNCkzNk7/h1q4rpDfADWyKvQ:TRnGnhlKVXlpkq7/NcDWyB

    Score
    10/10
    emotetepoch4bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks