Overview

overview

10

Static

static

3

93bb7a004f...f6.dll

windows7-x64

10

93bb7a004f...f6.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93bb7a004fa36427451a84f36636a82db212519aa004acd6d1a7dae0a55379f6

  • Size

    181KB

  • Sample

    241121-a82r7axkg1

  • MD5

    0b4d6608a1e92a636a9ad4514ec032d2

  • SHA1

    f1f00e6b7d15d6c205e414e4d28b68f99cadbcc4

  • SHA256

    93bb7a004fa36427451a84f36636a82db212519aa004acd6d1a7dae0a55379f6

  • SHA512

    19d79d31c9c082f0f1636f4551b466f45b5cdfee6cb6887ecaebb5dcb5e57a05e0b7d3b1914ace8446ff6675a5135182eb0ee89a0d5d84ee623369ccf69741e5

  • SSDEEP

    3072:z9AumHNEwvbQo77hmvswQNsn/GVQp9Ee1NVev7U8glXzSXdCrcJ/il:z9AuqEcbT9mUwQNs/Ge0e1N4vuNOXn/

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

178.153.27.12:80

201.193.160.196:80

89.163.210.141:8080

139.162.10.249:8080

203.157.152.9:7080

70.32.89.105:8080

24.245.65.66:80

77.89.249.254:443

116.202.10.123:8080

120.51.34.254:80

110.172.180.180:8080

157.7.164.178:8081

91.75.75.46:80

192.210.217.94:8080

78.90.78.210:80

190.18.184.113:80

180.52.66.193:80

188.166.220.180:7080

139.59.61.215:443

157.245.145.87:443
rsa_pubkey.plain

Targets

    • Target

      93bb7a004fa36427451a84f36636a82db212519aa004acd6d1a7dae0a55379f6

    • Size

      181KB

    • MD5

      0b4d6608a1e92a636a9ad4514ec032d2

    • SHA1

      f1f00e6b7d15d6c205e414e4d28b68f99cadbcc4

    • SHA256

      93bb7a004fa36427451a84f36636a82db212519aa004acd6d1a7dae0a55379f6

    • SHA512

      19d79d31c9c082f0f1636f4551b466f45b5cdfee6cb6887ecaebb5dcb5e57a05e0b7d3b1914ace8446ff6675a5135182eb0ee89a0d5d84ee623369ccf69741e5

    • SSDEEP

      3072:z9AumHNEwvbQo77hmvswQNsn/GVQp9Ee1NVev7U8glXzSXdCrcJ/il:z9AuqEcbT9mUwQNs/Ge0e1N4vuNOXn/

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks