Overview

overview

10

Static

static

10

988af3b90e...8N.exe

windows7-x64

988af3b90e...8N.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    988af3b90e9e4a80278dc720987a37554f58a82db3c1405795939d612e35bad8N.exe

  • Size

    106KB

  • MD5

    da245863eda3d8b203aae57e8f5399f0

  • SHA1

    36c3cd0c2ef450fdc5020d60866eff4ed5458fd2

  • SHA256

    988af3b90e9e4a80278dc720987a37554f58a82db3c1405795939d612e35bad8

  • SHA512

    338c0d477e107eadc6cda833daef2345b70b3f2928091cc7c7a04e9a6973c3c7ef58ec148c5c06db71a0f6fe44ed271abc6a16b244eb4446e520bd1b16023778

  • SSDEEP

    1536:o09zZsGUW5Kq+TIDHrb8fXqBmChV2z1y33P:dBT5aEHH8C5VG

Score
10/10
trojanbankerepoch1emotet

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.96.15.50:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

200.127.14.97:80

190.188.245.242:80

51.15.7.145:80

138.97.60.140:8080

98.13.75.196:80

213.52.74.198:80

74.58.215.226:80

192.81.38.31:80

191.182.6.118:80

212.71.237.140:8080

209.236.123.42:8080

60.93.23.51:80

178.211.45.66:8080

190.24.243.186:80

62.84.75.50:80

50.121.220.50:80
rsa_pubkey.plain

Signatures

  • Emotet family
    emotet
  • Emotet payload 1 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 988af3b90e9e4a80278dc720987a37554f58a82db3c1405795939d612e35bad8N.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections