emotet

General

Target

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
Size

524KB
Sample

220731-g8bz4adegq
MD5

143d2e2e29d56aa5706c4e7f64e26541
SHA1

3d939f114679f7f9a05375f34648fd51d567f77f
SHA256

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
SHA512

36e024c2370732105976484f330d3d61316e58f913b120f870da39cb3faae204a8894d64c7c542dc0cc870dc83984d7b9e128d4ee72a93aa94f53ddd9f8cd094

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.188.166.192:80

200.57.102.71:8443

200.21.90.6:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

181.36.42.205:443

114.79.134.129:443

62.75.143.100:7080

190.221.50.210:8080

201.184.65.229:80

79.143.182.254:8080

189.187.141.15:50000

190.1.37.125:443

189.129.4.186:80

46.41.151.103:8080

185.86.148.222:8080

46.163.144.228:80

rsa_pubkey.plain

Targets

- Target
  
  a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
- Size
  
  524KB
- MD5
  
  143d2e2e29d56aa5706c4e7f64e26541
- SHA1
  
  3d939f114679f7f9a05375f34648fd51d567f77f
- SHA256
  
  a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
- SHA512
  
  36e024c2370732105976484f330d3d61316e58f913b120f870da39cb3faae204a8894d64c7c542dc0cc870dc83984d7b9e128d4ee72a93aa94f53ddd9f8cd094
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2