Overview

overview

10

Static

static

3

ac93ee16ab...45.dll

windows7-x64

10

ac93ee16ab...45.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac93ee16ab1e0648c85073814b53014d8e916abfbc14f1501d409b3b956af745

  • Size

    384KB

  • Sample

    241120-thbmvszdjr

  • MD5

    ebcdcf7d980e1c8f41e34a4336450574

  • SHA1

    c55a416af0b3d135af51c0718abd6172b9a933bb

  • SHA256

    ac93ee16ab1e0648c85073814b53014d8e916abfbc14f1501d409b3b956af745

  • SHA512

    4db51969c6a6b73b38158de7853a3f35ae73e359b7d58eeca3143b6267786825404e1e7d1ab62cd03491ddbe670ef286e0603c3d581863c23d7a0dc1c6415504

  • SSDEEP

    6144:iWS1+ZeqYd2/W/MiXYczKCPXwYIJleswWa5qa95FOMhtq4MqnyOKmAHHNoTn:YGksW/xKuXPKdo5qa95AMhHybm5z

Score
10/10
emotetepoch4bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

46.55.222.11:443

104.245.52.73:8080

41.76.108.46:8080

103.8.26.103:8080

185.184.25.237:8080

103.8.26.102:8080

203.114.109.124:443

45.118.115.99:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

212.237.17.99:8080

212.237.56.116:7080

216.158.226.206:443
eck1.plain
ecs1.plain

Targets

    • Target

      ac93ee16ab1e0648c85073814b53014d8e916abfbc14f1501d409b3b956af745

    • Size

      384KB

    • MD5

      ebcdcf7d980e1c8f41e34a4336450574

    • SHA1

      c55a416af0b3d135af51c0718abd6172b9a933bb

    • SHA256

      ac93ee16ab1e0648c85073814b53014d8e916abfbc14f1501d409b3b956af745

    • SHA512

      4db51969c6a6b73b38158de7853a3f35ae73e359b7d58eeca3143b6267786825404e1e7d1ab62cd03491ddbe670ef286e0603c3d581863c23d7a0dc1c6415504

    • SSDEEP

      6144:iWS1+ZeqYd2/W/MiXYczKCPXwYIJleswWa5qa95FOMhtq4MqnyOKmAHHNoTn:YGksW/xKuXPKdo5qa95AMhHybm5z

    Score
    10/10
    emotetepoch4bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks