emotet

General

Target

ea17ccea356d9aea41d6b75461d7e04862651052270fc643c1efe9d66626140f.doc
Size

170KB
Sample

200731-bf9pr81afx
MD5

0ae7d86750581340bd3da288a5464be0
SHA1

32d42d062516ec7b783d0938641aa0ed25c7c74b
SHA256

ea17ccea356d9aea41d6b75461d7e04862651052270fc643c1efe9d66626140f
SHA512

1e333d4a545984f0e03aafcca3b30c5c0b3fc740cb8c6337f2a4311fbd44d4a8eb352639749adcb0d50cc347f86c818bfec71119c6acc526350664b76df7f476

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://pufferfiz.net/btrsports/3_qr_elsv8z8sb/

exe.dropper

http://rnetwork.com.br/administrator/itn1q_s_nhf/

exe.dropper

http://essoft.com/cgi-bin/bmkhn_v_pd5gahs8/

exe.dropper

http://dairyfocus.com.au/administrator/andxl/zvsg2_ijx_nd82wyrwn/

exe.dropper

http://kobes.net/cgi-bin/18i_56g1_o9cw7yj/

Extracted

Family

emotet

Botnet

Epoch2

C2

142.105.151.124:443

62.108.54.22:8080

212.51.142.238:8080

71.208.216.10:80

108.48.41.69:80

83.110.223.58:443

210.165.156.91:80

104.131.44.150:8080

104.236.246.93:8080

5.39.91.110:7080

209.141.54.221:8080

209.182.216.177:443

153.126.210.205:7080

91.211.88.52:7080

180.92.239.110:8080

183.101.175.193:80

162.241.92.219:8080

87.106.139.101:8080

114.146.222.200:80

65.111.120.223:80

rsa_pubkey.plain

Targets

- Target
  
  ea17ccea356d9aea41d6b75461d7e04862651052270fc643c1efe9d66626140f.doc
- Size
  
  170KB
- MD5
  
  0ae7d86750581340bd3da288a5464be0
- SHA1
  
  32d42d062516ec7b783d0938641aa0ed25c7c74b
- SHA256
  
  ea17ccea356d9aea41d6b75461d7e04862651052270fc643c1efe9d66626140f
- SHA512
  
  1e333d4a545984f0e03aafcca3b30c5c0b3fc740cb8c6337f2a4311fbd44d4a8eb352639749adcb0d50cc347f86c818bfec71119c6acc526350664b76df7f476
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1