emotet

Resubmissions

14-05-2022 18:44

220514-xdr1tsbbe3 10

14-05-2022 18:41

220514-xbz9esbbc7 10

14-05-2022 18:38

220514-xaa8xabbc6 10

Sharing

Copy URL

Twitter E-mail

General

Target

6514fd791cd14c3c2b0a3facae27cb906bdbe885091d4cc46b79b13fa2122c29
Size

532KB
Sample

220514-xdr1tsbbe3
MD5

e6b5174b1643e54dec66aaed271270ad
SHA1

0637e099726b60f3f81bd71ab986aea4d9a2eaf1
SHA256

6514fd791cd14c3c2b0a3facae27cb906bdbe885091d4cc46b79b13fa2122c29
SHA512

741e3601afb085ddccbe6f34a63eb5bd3bccc94ad9445d06358c8cf23d8c0bab4dde83298c3bf78f4b89dfd95767266447b8c60224af4ae818ee6c6d57b20fc8

Score

10^/10

Malware Config

Targets

- Target
  
  6514fd791cd14c3c2b0a3facae27cb906bdbe885091d4cc46b79b13fa2122c29
- Size
  
  532KB
- MD5
  
  e6b5174b1643e54dec66aaed271270ad
- SHA1
  
  0637e099726b60f3f81bd71ab986aea4d9a2eaf1
- SHA256
  
  6514fd791cd14c3c2b0a3facae27cb906bdbe885091d4cc46b79b13fa2122c29
- SHA512
  
  741e3601afb085ddccbe6f34a63eb5bd3bccc94ad9445d06358c8cf23d8c0bab4dde83298c3bf78f4b89dfd95767266447b8c60224af4ae818ee6c6d57b20fc8
Score

10^/10

emotet banker bootkit google discovery persistence phishing spyware stealer suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Registers COM server for autorun
  persistence
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Detected potential entity reuse from brand google.
  phishing google
- Drops file in System32 directory
behavioral1