Overview

overview

10

Static

static

3

7461269f12...08.exe

windows7-x64

10

7461269f12...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7461269f12fb5af0050b95209f6bbbde0b077a8f433b51dcfb51041429cbcb08.exe

  • Size

    688KB

  • Sample

    250212-ngwczsyqal

  • MD5

    ae8bf5f444b026a8c0cb8a18f776d5d0

  • SHA1

    295ec1ab9f4528ecc908e90b269ac286bd250ba1

  • SHA256

    7461269f12fb5af0050b95209f6bbbde0b077a8f433b51dcfb51041429cbcb08

  • SHA512

    d345be66dd73586647145f0ecb74f0ebf35eaeaf06fe81b351de982146705fa1fb90211a709b506017806cf0b5a5fb1df0b9eaf358bb1afff4d7607044a6d32f

  • SSDEEP

    12288:kKHbsgsHnI48scSuzFmUdt9W5glo1ddwK/:k1tHv8s2z0Ufc5Rl

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.234.133.205:80

212.51.142.238:8080

37.139.21.175:8080

74.208.45.104:8080

137.59.187.107:8080

37.187.72.193:8080

189.212.199.126:443

153.126.210.205:7080

81.2.235.111:8080

108.26.231.214:80

62.75.141.82:80

61.19.246.238:443

104.131.11.150:443

24.1.189.87:8080

87.106.139.101:8080

190.160.53.126:80

209.182.216.177:443

104.131.44.150:8080

95.179.229.244:8080

71.208.216.10:80
rsa_pubkey.plain

Targets

    • Target

      7461269f12fb5af0050b95209f6bbbde0b077a8f433b51dcfb51041429cbcb08.exe

    • Size

      688KB

    • MD5

      ae8bf5f444b026a8c0cb8a18f776d5d0

    • SHA1

      295ec1ab9f4528ecc908e90b269ac286bd250ba1

    • SHA256

      7461269f12fb5af0050b95209f6bbbde0b077a8f433b51dcfb51041429cbcb08

    • SHA512

      d345be66dd73586647145f0ecb74f0ebf35eaeaf06fe81b351de982146705fa1fb90211a709b506017806cf0b5a5fb1df0b9eaf358bb1afff4d7607044a6d32f

    • SSDEEP

      12288:kKHbsgsHnI48scSuzFmUdt9W5glo1ddwK/:k1tHv8s2z0Ufc5Rl

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks