emotet

General

Target

rimidkjf
Size

840KB
Sample

220731-f17lcsbdfr
MD5

406ac12181bdbb42a750ef38545afe02
SHA1

7f51b30226520b2e6865ed808bc1d01dd64d78cc
SHA256

fdc0245a18ce0dabe29c6ae596c7ca4144778923f71712f27c0f53b4114c2b1a
SHA512

b80274c1cc8a2db6a70317b9cf557d083d39d45725af93dda855c00bb8ac45d4c37aa711c3e10b706826727646ce1fce4516ad80df035bebf736bf77b8e022bd

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

197.245.25.228:80

98.103.204.12:443

59.148.253.194:8080

173.212.197.71:8080

87.106.46.107:8080

50.28.51.143:8080

177.73.0.98:443

213.197.182.158:8080

185.94.252.12:80

189.223.16.99:80

5.189.178.202:8080

186.103.141.250:443

181.129.96.162:8080

190.101.156.139:80

46.105.114.137:8080

51.15.7.145:80

98.13.75.196:80

202.134.4.210:7080

104.131.41.185:8080

181.123.6.86:80

rsa_pubkey.plain

Targets

- Target
  
  rimidkjf
- Size
  
  840KB
- MD5
  
  406ac12181bdbb42a750ef38545afe02
- SHA1
  
  7f51b30226520b2e6865ed808bc1d01dd64d78cc
- SHA256
  
  fdc0245a18ce0dabe29c6ae596c7ca4144778923f71712f27c0f53b4114c2b1a
- SHA512
  
  b80274c1cc8a2db6a70317b9cf557d083d39d45725af93dda855c00bb8ac45d4c37aa711c3e10b706826727646ce1fce4516ad80df035bebf736bf77b8e022bd
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2