emotet

General

Target

2024-02-21_0d80d2665beb62b25ec2c8c895586d74_icedid
Size

292KB
Sample

240221-vx2m9sca71
MD5

0d80d2665beb62b25ec2c8c895586d74
SHA1

1a032fa2bfe4f8aa71e468176258b71e4ec31060
SHA256

e813dff317de7d0190625bd299eb859814e4170e752d757d4a5d33d6970e0229
SHA512

1211b7cafe9cd40a3efd9fb0118dd200dd52610a6ef547c5ae10c1a757395f2e3ae1822b07f2e48b6e252fc211bcfecf9014fae9344ec37a352e47c0b397fb3f
SSDEEP

3072:TyDDt+sqWE654G+COT7xNyH0kB0Vzw/BlC5Igu86XBfL3BEcB4K5QvvQ2Uzai:wt+bYHnOT9hc0VEAIgu8m52Mx5QvM

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.192.39.136:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

190.190.15.20:80

181.95.133.104:80

41.212.89.128:80

115.176.16.221:80

143.95.101.72:8080

75.127.14.170:8080

116.202.10.123:8080

74.208.173.91:8080

103.93.220.182:80

50.116.78.109:8080

67.121.104.51:20

180.26.62.115:443

139.59.12.63:8080

76.18.16.210:80

113.161.148.81:80

5.79.70.250:8080

rsa_pubkey.plain

Targets

- Target
  
  2024-02-21_0d80d2665beb62b25ec2c8c895586d74_icedid
- Size
  
  292KB
- MD5
  
  0d80d2665beb62b25ec2c8c895586d74
- SHA1
  
  1a032fa2bfe4f8aa71e468176258b71e4ec31060
- SHA256
  
  e813dff317de7d0190625bd299eb859814e4170e752d757d4a5d33d6970e0229
- SHA512
  
  1211b7cafe9cd40a3efd9fb0118dd200dd52610a6ef547c5ae10c1a757395f2e3ae1822b07f2e48b6e252fc211bcfecf9014fae9344ec37a352e47c0b397fb3f
- SSDEEP
  
  3072:TyDDt+sqWE654G+COT7xNyH0kB0Vzw/BlC5Igu86XBfL3BEcB4K5QvvQ2Uzai:wt+bYHnOT9hc0VEAIgu8m52Mx5QvM
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2