Overview

overview

10

Static

static

3

2eabb8020e...eN.dll

windows7-x64

10

2eabb8020e...eN.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2eabb8020e2a3d04633941ade65c2becef5f43402ecc1cb3c0124f3d94e6461eN.exe

  • Size

    680KB

  • Sample

    250224-pgynsa1r13

  • MD5

    d28e35901885fd6a27c97a9270764de0

  • SHA1

    c15034f0190b1825123bdfe7b869e68406532fa3

  • SHA256

    2eabb8020e2a3d04633941ade65c2becef5f43402ecc1cb3c0124f3d94e6461e

  • SHA512

    481c4bac7864d0008fbd320063a07f54d1e547ec9af731b6c1277296401280ff5f3294546f96089a920a014b5152a15023a7623016b4294516880707a4319191

  • SSDEEP

    12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7vvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zBCMV0rdAMu

Score
10/10
emotetepoch4bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

216.120.236.62:8080

189.232.46.161:443

51.91.76.89:8080

217.182.25.250:8080

119.193.124.41:7080

159.8.59.82:8080

195.201.151.129:8080

58.227.42.236:80

212.24.98.99:8080

138.185.72.26:8080

131.100.24.231:80

192.99.251.50:443

158.69.222.101:443

197.242.150.244:8080

50.116.54.215:443

188.44.20.25:443

212.237.17.99:8080

153.126.146.25:7080

103.75.201.2:443

5.9.116.246:8080
eck1.plain
ecs1.plain

Targets

    • Target

      2eabb8020e2a3d04633941ade65c2becef5f43402ecc1cb3c0124f3d94e6461eN.exe

    • Size

      680KB

    • MD5

      d28e35901885fd6a27c97a9270764de0

    • SHA1

      c15034f0190b1825123bdfe7b869e68406532fa3

    • SHA256

      2eabb8020e2a3d04633941ade65c2becef5f43402ecc1cb3c0124f3d94e6461e

    • SHA512

      481c4bac7864d0008fbd320063a07f54d1e547ec9af731b6c1277296401280ff5f3294546f96089a920a014b5152a15023a7623016b4294516880707a4319191

    • SSDEEP

      12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7vvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zBCMV0rdAMu

    Score
    10/10
    emotetepoch4bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks