emotet

General

Target

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
Size

166KB
Sample

220724-vda17sbdc5
MD5

692b5738f923a8b6ed55f3ad76daf5d4
SHA1

4c57090c7d3f8507ab88cee0720d44caa4550ec8
SHA256

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
SHA512

d48cb39b382f6a4423f80a4a7cb23e0af93259ecaeabc3a388c24ed9687121aaae82319dc757d66eaee182c846006471809e85830afc9dbad70e5cd13c1efdfa

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.99.235.57:80

187.199.158.226:443

186.0.95.172:80

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

109.169.86.13:8080

190.200.64.180:7080

217.113.27.158:443

71.244.60.231:7080

46.21.105.59:8080

179.62.18.56:443

211.229.116.97:80

88.250.223.190:8080

181.188.149.134:80

91.205.215.57:7080

190.230.60.129:80

77.55.211.77:8080

rsa_pubkey.plain

Targets

- Target
  
  7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
- Size
  
  166KB
- MD5
  
  692b5738f923a8b6ed55f3ad76daf5d4
- SHA1
  
  4c57090c7d3f8507ab88cee0720d44caa4550ec8
- SHA256
  
  7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
- SHA512
  
  d48cb39b382f6a4423f80a4a7cb23e0af93259ecaeabc3a388c24ed9687121aaae82319dc757d66eaee182c846006471809e85830afc9dbad70e5cd13c1efdfa
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2