Overview

overview

10

Static

static

3

6f048b44ac...d2.exe

windows7-x64

10

6f048b44ac...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f048b44acb51c6382b19f8a0ffb5fe85210dd6f3b45a624d6710536aab94fd2.exe

  • Size

    320KB

  • Sample

    250109-dvxsvsymek

  • MD5

    ca4c6b8875dae2f9008f3175b410356c

  • SHA1

    9cd9081d620228a87aff46ac1a16c00cc43d9f7f

  • SHA256

    6f048b44acb51c6382b19f8a0ffb5fe85210dd6f3b45a624d6710536aab94fd2

  • SHA512

    7e237c181e0f7f41fab7d8bfb270b5940d4e3ec903bdf238efcf48d39e2adb36362eb175b71dbdc7ce00dc10f3a6926c843c71760ae227c36d3eb26665ae0af7

  • SSDEEP

    6144:SMeVGThcCLoa1BsQKJSjog73p6ekMpIK4L+vMtMKE:SOLDlLog7YekMGDqvn

Score
10/10
emotetepoch1bankerdavediscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080
rsa_pubkey.plain

Targets

    • Target

      6f048b44acb51c6382b19f8a0ffb5fe85210dd6f3b45a624d6710536aab94fd2.exe

    • Size

      320KB

    • MD5

      ca4c6b8875dae2f9008f3175b410356c

    • SHA1

      9cd9081d620228a87aff46ac1a16c00cc43d9f7f

    • SHA256

      6f048b44acb51c6382b19f8a0ffb5fe85210dd6f3b45a624d6710536aab94fd2

    • SHA512

      7e237c181e0f7f41fab7d8bfb270b5940d4e3ec903bdf238efcf48d39e2adb36362eb175b71dbdc7ce00dc10f3a6926c843c71760ae227c36d3eb26665ae0af7

    • SSDEEP

      6144:SMeVGThcCLoa1BsQKJSjog73p6ekMpIK4L+vMtMKE:SOLDlLog7YekMGDqvn

    Score
    10/10
    emotetepoch1bankerdavediscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks