#Emotet E5 Update - Within the last several hours, we have seen some bots on the Epoch 5 botnet begin to drop SystemBC now as a module and execute it. This is the first drop beyond Cobalt Strike that we have seen since Emotet returned. This is a significant change 1/x
For the instance of SystemBC we saw dropped, the C2 was 96.30.196[.]207:4177
45.32.132[.]182:4177
SystemBC sample here:
tria.ge/220310-3dqqnac…
This did not seem to be dropped on all bots on the E5 botnet but it was at least some that were geolocated in the USA. 2/x
45.32.132[.]182:4177
SystemBC sample here:
tria.ge/220310-3dqqnac…
This did not seem to be dropped on all bots on the E5 botnet but it was at least some that were geolocated in the USA. 2/x
We have heard of other researchers also seeing the same drops of SystemBC. This activity seemed to start around 18:00-19:00UTC today. We will keep you informed if we see any more drops or anything on E4 which seems to be having problems even functioning correctly. GG Ivan. 3/3
• • •
Missing some Tweet in this thread? You can try to
force a refresh
