emotet

General

Target

47159abdd9c8dc0962a3d9173002f47ff5438a27a24c3fcc21ba35550ba5923b
Size

364KB
Sample

220714-jnge7agah3
MD5

dd5952eae75f3ec5e2803b42c1bba39f
SHA1

973963adee52a041d04bf3334b82222bfd5bc3de
SHA256

47159abdd9c8dc0962a3d9173002f47ff5438a27a24c3fcc21ba35550ba5923b
SHA512

7b2bd1ee29fd1ec19e457df6764a0b74692840c2b7949313960a4a36c56d1ccfd77aa26f30c876ccf43e869841892ba403e25a6ea2bebb5dc7ca7bd6096857a4

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

190.106.97.230:443

24.51.106.145:21

186.4.172.5:443

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

92.222.125.16:7080

182.176.106.43:995

31.12.67.62:7080

37.157.194.134:443

85.106.1.166:50000

201.251.43.69:8080

136.243.177.26:8080

104.131.11.150:8080

190.201.164.223:53

103.97.95.218:143

190.53.135.159:21

138.201.140.110:8080

80.11.163.139:21

rsa_pubkey.plain

Targets

- Target
  
  47159abdd9c8dc0962a3d9173002f47ff5438a27a24c3fcc21ba35550ba5923b
- Size
  
  364KB
- MD5
  
  dd5952eae75f3ec5e2803b42c1bba39f
- SHA1
  
  973963adee52a041d04bf3334b82222bfd5bc3de
- SHA256
  
  47159abdd9c8dc0962a3d9173002f47ff5438a27a24c3fcc21ba35550ba5923b
- SHA512
  
  7b2bd1ee29fd1ec19e457df6764a0b74692840c2b7949313960a4a36c56d1ccfd77aa26f30c876ccf43e869841892ba403e25a6ea2bebb5dc7ca7bd6096857a4
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2