emotet

General

Target

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
Size

65KB
Sample

220306-t39qdsecbk
MD5

0bba6c71db455965f4ebd76de79ee74f
SHA1

8343aafa8f82aaad2b49f1f69cf43bb023dbd682
SHA256

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
SHA512

a030ae0a1c27b4d197e21b2b9afc0e305411647345e4ef26cc1ec0ef5dbf9eb9f6a844d3fe213248b0cbd9ff1b2d602b092eb71269c440f55244ea62030fdf25

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

85.25.138.55:8080

212.129.24.79:8080

37.187.2.199:443

86.22.221.170:80

190.211.207.11:443

173.249.47.77:8080

94.177.216.217:8080

83.136.245.190:8080

115.78.95.230:443

181.143.194.138:443

5.196.74.210:8080

198.199.114.69:8080

190.228.72.244:53

190.53.135.159:21

189.209.217.49:80

103.39.131.88:80

136.243.177.26:8080

206.189.98.125:8080

91.205.215.66:8080

200.51.94.251:80

rsa_pubkey.plain

Targets

- Target
  
  af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
- Size
  
  65KB
- MD5
  
  0bba6c71db455965f4ebd76de79ee74f
- SHA1
  
  8343aafa8f82aaad2b49f1f69cf43bb023dbd682
- SHA256
  
  af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
- SHA512
  
  a030ae0a1c27b4d197e21b2b9afc0e305411647345e4ef26cc1ec0ef5dbf9eb9f6a844d3fe213248b0cbd9ff1b2d602b092eb71269c440f55244ea62030fdf25
Score

10^/10

emotet banker suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
  suricata
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
  suricata
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
  suricata
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2