Overview

overview

10

Static

static

3

448d27e61e...58.dll

windows7-x64

10

448d27e61e...58.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    202ff060bb9ae37183100f6b36aebcf2b6363493eb41f13f1319facb7e28996e

  • Size

    483KB

  • Sample

    241120-v4zr9avldr

  • MD5

    2bc02cee6a9f3d5375bef0acad706120

  • SHA1

    37d4a50f315244bcccf2e44843eca85d16074e3e

  • SHA256

    202ff060bb9ae37183100f6b36aebcf2b6363493eb41f13f1319facb7e28996e

  • SHA512

    7d77059c3e59225c82583dfd80d08183672dc5002cd095722bf62bc1f03f910bb40fa02f517d0fe04c2cbef2a5bba1f14faaa7669d1231bda702d2eb6ebe8869

  • SSDEEP

    6144:1d6geK29dpjo4iBC6omYdcYxMEHHL9ae7GegiZuweAC1hQzDTYy6P/0rRxZvQLfT:6gf29cTBC3dcYxMk7G0toADcyrQL73

Score
10/10
emotetepoch4bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

169.197.131.16:8080

195.154.253.60:8080

152.89.239.34:443

216.158.226.206:443

159.65.88.10:8080

209.126.98.206:8080

158.69.222.101:443

173.212.193.249:8080

185.157.82.211:8080

81.0.236.90:443

103.75.201.2:443

46.55.222.11:443

159.8.59.82:8080

207.38.84.195:8080

50.116.54.215:443

79.172.212.216:8080

212.237.17.99:8080

212.24.98.99:8080

178.79.147.66:8080

51.254.140.238:7080
eck1.plain
ecs1.plain

Targets

    • Target

      448d27e61ea0ab9dfca3f85e2eac6c259491b76815a37a75f844ea63f6f80e58

    • Size

      1024KB

    • MD5

      0b0d9a74e5f99ef48fea085809be829b

    • SHA1

      b92e1292ddaad1c2afcaaa3eacd8698b360b9d39

    • SHA256

      448d27e61ea0ab9dfca3f85e2eac6c259491b76815a37a75f844ea63f6f80e58

    • SHA512

      61297cbb7709e3a4160d2643aefe7925a128f3782920e44968d07bdc767c6d15ea152116ac057bc9e4ad2d07afe38007ccc8fb111fee8f3a8ba77234e193078f

    • SSDEEP

      12288:lVHxC/pAfc4onhlKVXlcNCkzNk7/huq4rpDfADWyKvQ:TRnGnhlKVXlpkq7/ucDWyB

    Score
    10/10
    emotetepoch4bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks