Overview

overview

10

Static

static

3

fa483a7385...48.exe

windows7-x64

10

fa483a7385...48.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fa483a738552d5f47aa1b1448c6348a447664c775937ca6ff71cf89c53acf248

  • Size

    628KB

  • Sample

    241120-zwtcqatka1

  • MD5

    9823655d92dd8402f41b98c1540dd4e4

  • SHA1

    f0856c4ce31ef6981b6585ecbcdd45a98f3bdcac

  • SHA256

    fa483a738552d5f47aa1b1448c6348a447664c775937ca6ff71cf89c53acf248

  • SHA512

    a0fe3a054259d665810c1e42af2bf4a0bddac62859f7c727d9c0bfb0d962e251ef2ac1a67ecd74bea8481e57160d63f23b3831b9e13e568292ed953ffa42f55e

  • SSDEEP

    6144:p5FdA9+3bkRQIwYEgRy2k46fifqlhyBQLzaWSP3nxyhXf:pvdA9SGh9rBylQB4atvnxs

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

144.139.91.187:443

157.7.199.53:8080

189.218.165.63:80

104.236.161.64:8080

2.47.112.152:80

185.94.252.27:443

202.62.39.111:80

190.17.195.202:80

143.0.87.101:80

70.32.84.74:8080

45.161.242.102:80

190.194.242.254:443

50.28.51.143:8080

204.225.249.100:7080

137.74.106.111:7080

68.183.170.114:8080

181.31.211.181:80

149.62.173.247:8080

177.75.143.112:443

190.229.148.144:80
rsa_pubkey.plain

Targets

    • Target

      fa483a738552d5f47aa1b1448c6348a447664c775937ca6ff71cf89c53acf248

    • Size

      628KB

    • MD5

      9823655d92dd8402f41b98c1540dd4e4

    • SHA1

      f0856c4ce31ef6981b6585ecbcdd45a98f3bdcac

    • SHA256

      fa483a738552d5f47aa1b1448c6348a447664c775937ca6ff71cf89c53acf248

    • SHA512

      a0fe3a054259d665810c1e42af2bf4a0bddac62859f7c727d9c0bfb0d962e251ef2ac1a67ecd74bea8481e57160d63f23b3831b9e13e568292ed953ffa42f55e

    • SSDEEP

      6144:p5FdA9+3bkRQIwYEgRy2k46fifqlhyBQLzaWSP3nxyhXf:pvdA9SGh9rBylQB4atvnxs

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks