emotet | 849ec60a8d28774f617aec36a59bf3b00b292dc9cc3a726dcb8798c164460c93 | Triage

Sharing

General

Target

849ec60a8d28774f617aec36a59bf3b00b292dc9cc3a726dcb8798c164460c93
Size

712KB
Sample

221103-vgxpdafaaj
MD5

94ac36f12999466b948e0e1ea0387902
SHA1

f29b0de696d7495db81bb2c0dc4c8b6d094d636f
SHA256

849ec60a8d28774f617aec36a59bf3b00b292dc9cc3a726dcb8798c164460c93
SHA512

3e4e46a6a0e7c7432ae8c0a451b9332c788d7ffcca3bbc5df6c30b0bf1b89287de5f578d5b7f4ea33df56ffa5010b4ba1f6f17fb0ab5d55f28d3d6b8d96680a9
SSDEEP

12288:Jm3ryg7+tKkrxfIoAGA8YHrKre+kca011br+0MACwlg6WggbE/A4:JuryW+5rNIoJZYHrKretBjWCN4

Score

10^/10

emotet banker persistence trojan

Malware Config

Targets

- Target
  
  849ec60a8d28774f617aec36a59bf3b00b292dc9cc3a726dcb8798c164460c93
- Size
  
  712KB
- MD5
  
  94ac36f12999466b948e0e1ea0387902
- SHA1
  
  f29b0de696d7495db81bb2c0dc4c8b6d094d636f
- SHA256
  
  849ec60a8d28774f617aec36a59bf3b00b292dc9cc3a726dcb8798c164460c93
- SHA512
  
  3e4e46a6a0e7c7432ae8c0a451b9332c788d7ffcca3bbc5df6c30b0bf1b89287de5f578d5b7f4ea33df56ffa5010b4ba1f6f17fb0ab5d55f28d3d6b8d96680a9
- SSDEEP
  
  12288:Jm3ryg7+tKkrxfIoAGA8YHrKre+kca011br+0MACwlg6WggbE/A4:JuryW+5rNIoJZYHrKretBjWCN4
Score

10^/10

emotet banker persistence trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

emotetbankerpersistencetrojan