emotet

General

Target

mw5go9sX5gzFc06t.dll
Size

548KB
Sample

220120-ybwrnsbch2
MD5

c7f0fcd06b6757af2bbb33cc2cfb81c3
SHA1

231300463ad19358fc71ef8c1a4a358967887594
SHA256

0a8cebd3dbaaaec6da67ecc981207a79a0f386290bf9e5495b03ef4e5aad68d7
SHA512

be908ce404b23212e7d81e0926b946035426f0fe16b253bc0b5f5177fe8a1c3a29a482ce7453117a62780f516f0f4d2a8051572778c8881b9c1e4a8453bd4eca

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain

ecs1.plain

Targets

- Target
  
  mw5go9sX5gzFc06t.dll
- Size
  
  548KB
- MD5
  
  c7f0fcd06b6757af2bbb33cc2cfb81c3
- SHA1
  
  231300463ad19358fc71ef8c1a4a358967887594
- SHA256
  
  0a8cebd3dbaaaec6da67ecc981207a79a0f386290bf9e5495b03ef4e5aad68d7
- SHA512
  
  be908ce404b23212e7d81e0926b946035426f0fe16b253bc0b5f5177fe8a1c3a29a482ce7453117a62780f516f0f4d2a8051572778c8881b9c1e4a8453bd4eca
Score

10^/10

emotet epoch4 banker trojan persistence
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Sets service image path in registry

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2