General

  • Target

    HEUR-Trojan-Banker.Win32.Emotet.pef-d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe.exe

  • Size

    640KB

  • Sample

    220831-elt62sabe4

  • MD5

    77f4f9d3573beaa5d91aa7ebca45d2e1

  • SHA1

    0058a4d2667c2ef7ee806ae5c39f4faa318593af

  • SHA256

    d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe

  • SHA512

    5069afeb5cd11d6b05904005c06dc663f770df258b32d36a0e17c6ed060f62e792fe68bc717047e7d482df36c45b9778113e46f0840ba4ff4ba33fcd19400b90

  • SSDEEP

    6144:aZ8LXFyqywQQCaKFh2gf8DVC0Vm8rFqUBscFH85fqtN/5jfm/CXK6TiRWBYUT/O:aZ8uQCaGhSDTk8rF/BFJNRkn4iRki

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

82.225.49.121:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

203.117.253.142:80

139.99.158.11:443

87.106.139.101:8080

190.160.53.126:80

5.39.91.110:7080

107.5.122.110:80

174.102.48.180:443

194.187.133.160:443

153.177.101.120:443

104.236.246.93:8080

78.24.219.147:8080

94.23.237.171:443

85.66.181.138:80

157.245.99.39:8080

201.173.217.124:443

91.211.88.52:7080

rsa_pubkey.plain

Targets

    • Target

      HEUR-Trojan-Banker.Win32.Emotet.pef-d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe.exe

    • Size

      640KB

    • MD5

      77f4f9d3573beaa5d91aa7ebca45d2e1

    • SHA1

      0058a4d2667c2ef7ee806ae5c39f4faa318593af

    • SHA256

      d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe

    • SHA512

      5069afeb5cd11d6b05904005c06dc663f770df258b32d36a0e17c6ed060f62e792fe68bc717047e7d482df36c45b9778113e46f0840ba4ff4ba33fcd19400b90

    • SSDEEP

      6144:aZ8LXFyqywQQCaKFh2gf8DVC0Vm8rFqUBscFH85fqtN/5jfm/CXK6TiRWBYUT/O:aZ8uQCaGhSDTk8rF/BFJNRkn4iRki

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks