emotet | 69734d45ad6341114d7a442f8b93e4e5b7dce6553f5b316d52ba4f8827d86221 | Triage

Sharing

General

Target

69734d45ad6341114d7a442f8b93e4e5b7dce6553f5b316d52ba4f8827d86221
Size

653KB
Sample

211125-tgbw8sbad4
MD5

527790232d24c2beae64244076ba6fb4
SHA1

bb50a88bf78c654c36f8c1f934b55f2ea4d46719
SHA256

69734d45ad6341114d7a442f8b93e4e5b7dce6553f5b316d52ba4f8827d86221
SHA512

e5e6899e8bb25279dd48c9840a7395f21fee162f856f0cda1827617fe7734a17e06f7c8310b2158209586480d96909484b78e94bc30e7135cdbf8fc0d4af0894

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

51.178.61.60:443

168.197.250.14:80

45.79.33.48:8080

196.44.98.190:8080

177.72.80.14:7080

51.210.242.234:8080

185.148.169.10:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

191.252.103.16:80

54.38.242.185:443

85.214.67.203:8080

54.37.228.122:443

207.148.81.119:8080

195.77.239.39:8080

66.42.57.149:443

195.154.146.35:443

eck1.plain

ecs1.plain

Targets

- Target
  
  69734d45ad6341114d7a442f8b93e4e5b7dce6553f5b316d52ba4f8827d86221
- Size
  
  653KB
- MD5
  
  527790232d24c2beae64244076ba6fb4
- SHA1
  
  bb50a88bf78c654c36f8c1f934b55f2ea4d46719
- SHA256
  
  69734d45ad6341114d7a442f8b93e4e5b7dce6553f5b316d52ba4f8827d86221
- SHA512
  
  e5e6899e8bb25279dd48c9840a7395f21fee162f856f0cda1827617fe7734a17e06f7c8310b2158209586480d96909484b78e94bc30e7135cdbf8fc0d4af0894
Score

10^/10

emotet epoch5 banker persistence trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Registers COM server for autorun
  persistence
- Blocklisted process makes network request
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

emotetepoch5bankerpersistencetrojan