emotet

General

Target

629f1340192caf21b745cf7848e6f806a559fd3f80a347a4794825c2a1e31c91
Size

78KB
Sample

220307-fw1l9aagej
MD5

e467e386d20f45991b9620b4b762556c
SHA1

bf386a9fef1cf1eef6ac860b184ba5618ba212d9
SHA256

629f1340192caf21b745cf7848e6f806a559fd3f80a347a4794825c2a1e31c91
SHA512

e48be184a68524f2834cf8f16cd50ef34b46f3767768a2e6587d721c3a72039ee1bd7c02e979ff5641e87925dbc010ae12506d347a9d8c5a341720554b261724

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

190.108.228.48:990

119.15.153.237:80

31.12.67.62:7080

80.11.163.139:21

190.226.44.20:21

45.33.49.124:443

103.97.95.218:143

187.144.189.58:50000

211.63.71.72:8080

182.76.6.2:8080

138.201.140.110:8080

190.145.67.134:8090

169.239.182.217:8080

46.105.131.87:80

78.24.219.147:8080

91.205.215.66:8080

85.104.59.244:20

rsa_pubkey.plain

Targets

- Target
  
  629f1340192caf21b745cf7848e6f806a559fd3f80a347a4794825c2a1e31c91
- Size
  
  78KB
- MD5
  
  e467e386d20f45991b9620b4b762556c
- SHA1
  
  bf386a9fef1cf1eef6ac860b184ba5618ba212d9
- SHA256
  
  629f1340192caf21b745cf7848e6f806a559fd3f80a347a4794825c2a1e31c91
- SHA512
  
  e48be184a68524f2834cf8f16cd50ef34b46f3767768a2e6587d721c3a72039ee1bd7c02e979ff5641e87925dbc010ae12506d347a9d8c5a341720554b261724
Score

10^/10

emotet banker suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
  suricata
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
  suricata
- suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
  suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
  suricata
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3

suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2