emotet

General

Target

03c00bbd77a823cb5d77e47811f8e6ea_JaffaCakes118
Size

216KB
Sample

240427-17kqdsaa7z
MD5

03c00bbd77a823cb5d77e47811f8e6ea
SHA1

462093512e063978acaed31c41e822788c0535ff
SHA256

e2e8a39be258007c41d8d3d7ec64d8e19fed5e28f6de774ba263b5a180597103
SHA512

a976505f1ada620b97faf51f17a3000c54cf5c2dfef0af1d5b733439db5a08b14208eb2c5cb3fc5ee22c022f49ac3108830bf52a54fa9bec20ae834993bfd9f1
SSDEEP

6144:426zQqGAvo3zkc4ccld5b2IOIQlNtGZknCko7Xs2sZI:4JGAgj18w2sC

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.30.61.163:443

209.126.6.222:8080

5.153.250.14:8080

188.135.15.49:80

104.131.41.185:8080

178.250.54.208:8080

50.28.51.143:8080

170.81.48.2:80

87.106.46.107:8080

191.99.160.58:80

187.162.248.237:80

89.32.150.160:8080

46.28.111.142:7080

190.190.148.27:8080

190.115.18.139:8080

178.79.163.131:8080

73.213.208.163:80

219.92.8.17:8080

95.9.180.128:80

212.71.237.140:8080

rsa_pubkey.plain

Targets

- Target
  
  03c00bbd77a823cb5d77e47811f8e6ea_JaffaCakes118
- Size
  
  216KB
- MD5
  
  03c00bbd77a823cb5d77e47811f8e6ea
- SHA1
  
  462093512e063978acaed31c41e822788c0535ff
- SHA256
  
  e2e8a39be258007c41d8d3d7ec64d8e19fed5e28f6de774ba263b5a180597103
- SHA512
  
  a976505f1ada620b97faf51f17a3000c54cf5c2dfef0af1d5b733439db5a08b14208eb2c5cb3fc5ee22c022f49ac3108830bf52a54fa9bec20ae834993bfd9f1
- SSDEEP
  
  6144:426zQqGAvo3zkc4ccld5b2IOIQlNtGZknCko7Xs2sZI:4JGAgj18w2sC
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2