emotet

General

Target

f200fbf710facc82e730cc85d40539191f7623ec2a48056ae2759a8a28089aca
Size

57KB
Sample

220306-q2accscegj
MD5

eca3eeab4055a5223286043c9fa26d64
SHA1

f78161a91429a3b384438380a130075cd792c716
SHA256

f200fbf710facc82e730cc85d40539191f7623ec2a48056ae2759a8a28089aca
SHA512

dea1663c1eb15bda2eeeac71fcd7b541f3dbbaf2171b5b22d7803bf062a5f661ca4d473391deb28311df214468f33d48b91e0296cee5774e7614fd2ae97dede9

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

23.239.29.211:443

198.199.114.69:8080

80.79.23.144:443

186.4.172.5:20

31.12.67.62:7080

178.254.6.27:7080

178.79.161.166:443

87.106.139.101:8080

211.63.71.72:8080

87.230.19.21:8080

41.220.119.246:80

80.11.163.139:443

190.228.72.244:53

192.254.173.31:8080

190.53.135.159:21

212.71.234.16:8080

95.128.43.213:8080

190.108.228.48:990

85.104.59.244:20

190.106.97.230:443

rsa_pubkey.plain

Targets

- Target
  
  f200fbf710facc82e730cc85d40539191f7623ec2a48056ae2759a8a28089aca
- Size
  
  57KB
- MD5
  
  eca3eeab4055a5223286043c9fa26d64
- SHA1
  
  f78161a91429a3b384438380a130075cd792c716
- SHA256
  
  f200fbf710facc82e730cc85d40539191f7623ec2a48056ae2759a8a28089aca
- SHA512
  
  dea1663c1eb15bda2eeeac71fcd7b541f3dbbaf2171b5b22d7803bf062a5f661ca4d473391deb28311df214468f33d48b91e0296cee5774e7614fd2ae97dede9
Score

10^/10

emotet banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2