Overview

overview

10

Static

static

5

7b57b090f4...1N.exe

windows7-x64

10

7b57b090f4...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b57b090f403a29838bab33fd64006d11a433f54805ad244c0496c26522cf661N.exe

  • Size

    114KB

  • Sample

    241219-b9hals1qcs

  • MD5

    b32879e40e9a61421131dc091c6d78a0

  • SHA1

    49a449b396b6c422dfa699e82711aff4b796ddd1

  • SHA256

    7b57b090f403a29838bab33fd64006d11a433f54805ad244c0496c26522cf661

  • SHA512

    4b1d71c5f2932384298134e670f3ee816cea8f776bb8c243e36d7db467376c08fabb79d929a755b7688a225dd75af60cb7ee5c1725123a8b238a9375c1f3368c

  • SSDEEP

    3072:4PBI9iBSOX4XNt3poZxmNFsy2npe7QdP/VJ5L:wI9x/X/3po7+syMpbVVP

Score
10/10
emotetepoch1bankerdiscoverytrojanupx

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

189.173.113.67:443

200.123.101.90:80

170.130.31.177:8080

51.255.165.160:8080

45.56.79.249:443

185.86.148.222:8080

190.4.50.26:80

187.188.166.192:80

94.177.183.28:8080

201.213.32.59:80

76.69.29.42:80

190.96.118.15:443

81.213.215.216:50000

80.85.87.122:8080

186.1.41.111:443

183.82.97.25:80

220.241.38.226:50000

14.160.93.230:80

200.58.83.179:80

138.68.106.4:7080
rsa_pubkey.plain

Targets

    • Target

      7b57b090f403a29838bab33fd64006d11a433f54805ad244c0496c26522cf661N.exe

    • Size

      114KB

    • MD5

      b32879e40e9a61421131dc091c6d78a0

    • SHA1

      49a449b396b6c422dfa699e82711aff4b796ddd1

    • SHA256

      7b57b090f403a29838bab33fd64006d11a433f54805ad244c0496c26522cf661

    • SHA512

      4b1d71c5f2932384298134e670f3ee816cea8f776bb8c243e36d7db467376c08fabb79d929a755b7688a225dd75af60cb7ee5c1725123a8b238a9375c1f3368c

    • SSDEEP

      3072:4PBI9iBSOX4XNt3poZxmNFsy2npe7QdP/VJ5L:wI9x/X/3po7+syMpbVVP

    Score
    10/10
    emotetepoch1bankerdiscoverytrojanupx

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks