Overview

overview

10

Static

static

10

2026-04-17...ze.exe

windows10-2004-x64

10

2026-04-17...ze.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-17_6ad036ba211d633b0404e8b2cb435e63_elex_emotet_maze
  • Size 61KB
  • Sample260417-mx2dhaex4t
  • SHA256 74096d3bcea3a40a77169920c008806242df2e8f46d1da020d357781186722b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
epoch3trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 190.117.206.153:443

  • 203.99.187.137:443

  • 200.55.168.82:20

  • 70.32.94.58:8080

  • 213.138.100.98:8080

  • 144.76.62.10:8080

  • 203.99.188.203:990

  • 201.196.15.79:990

  • 203.99.182.135:443

  • 176.58.93.123:80

  • 192.241.220.183:8080

  • 94.177.253.126:80

  • 181.47.235.26:993

  • 216.75.37.196:8080

  • 95.216.207.86:7080

  • 78.109.34.178:443

  • 113.52.135.33:7080

  • 216.70.88.55:8080

  • 138.197.140.163:8080

  • 181.113.229.139:990

rsa_pubkey.plain

Signatures

  • Family: Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-04-17_6ad036ba211d633b0404e8b2cb435e63_elex_emotet_maze
    .exe 61KB

2026-04-17_6ad036ba211d633b0404e8b2cb435e63_elex_emotet_maze

  • IMPHASH 009889c73bd2e55113bf6dfa5f395e0d
  • SHA256 74096d3bcea3a40a77169920c008806242df2e8f46d1da020d357781186722b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx86arch:x86

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
52631
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths