emotet

General

Target

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96
Size

216KB
Sample

220724-vdbyhabfap
MD5

23d5ae6d628d21faf98e8f29c7f91b1a
SHA1

7dbf772a085b093c7cfed6c79b26a21b85fc9a77
SHA256

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96
SHA512

4c72ccc0d7c83588be4e65e7475879ea3459818da5e9fbedbe4c866031460d715057ed48299538ea6c470318eaa00c1f9adcb676f1f711a30309067ecd0b1fe5

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.117.206.153:443

179.62.18.56:443

123.168.4.66:22

178.249.187.151:8080

217.199.160.224:8080

62.75.150.240:7080

71.244.60.230:7080

119.59.124.163:8080

211.229.116.97:80

190.38.14.52:80

217.113.27.158:443

203.25.159.3:8080

190.19.42.131:80

187.188.166.192:80

51.15.8.192:8080

23.92.22.225:7080

189.166.68.89:443

88.250.223.190:8080

189.129.4.186:80

86.42.166.147:80

rsa_pubkey.plain

Targets

- Target
  
  ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96
- Size
  
  216KB
- MD5
  
  23d5ae6d628d21faf98e8f29c7f91b1a
- SHA1
  
  7dbf772a085b093c7cfed6c79b26a21b85fc9a77
- SHA256
  
  ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96
- SHA512
  
  4c72ccc0d7c83588be4e65e7475879ea3459818da5e9fbedbe4c866031460d715057ed48299538ea6c470318eaa00c1f9adcb676f1f711a30309067ecd0b1fe5
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2