emotet

General

Target

e2715f6ba1fa0b5f348f08da60beab47692321ae8970ac91ccb1f8b6cb1622a1.exe
Size

356KB
Sample

240226-xsph9ade35
MD5

3a39e0b993ca9d1132a283c690df267c
SHA1

b4fa85b0ecafc030f15363d88817bb60d073ad8c
SHA256

e2715f6ba1fa0b5f348f08da60beab47692321ae8970ac91ccb1f8b6cb1622a1
SHA512

1bb35295817a4dc680a8f00060f25841358c6604a31b8c489a2ded93c072df923744b5c8c84b6cbb8f713922369bd027ce44d20937130deb558fe984b166dde1
SSDEEP

6144:BLLQWL3zntFj3OB0LPJQOZGhcvSSj2x+TGLNs3EtU7L:BQeFTOAQIacvSS6oqLFtsL

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

102.182.145.130:80

173.173.254.105:80

64.207.182.168:8080

51.89.199.141:8080

167.114.153.111:8080

173.63.222.65:80

218.147.193.146:80

59.125.219.109:443

172.104.97.173:8080

190.162.215.233:80

68.115.186.26:80

78.188.106.53:443

190.240.194.77:443

24.133.106.23:80

80.227.52.78:80

79.137.83.50:443

120.150.218.241:443

62.171.142.179:8080

194.4.58.192:7080

62.30.7.67:443

rsa_pubkey.plain

Targets

- Target
  
  e2715f6ba1fa0b5f348f08da60beab47692321ae8970ac91ccb1f8b6cb1622a1.exe
- Size
  
  356KB
- MD5
  
  3a39e0b993ca9d1132a283c690df267c
- SHA1
  
  b4fa85b0ecafc030f15363d88817bb60d073ad8c
- SHA256
  
  e2715f6ba1fa0b5f348f08da60beab47692321ae8970ac91ccb1f8b6cb1622a1
- SHA512
  
  1bb35295817a4dc680a8f00060f25841358c6604a31b8c489a2ded93c072df923744b5c8c84b6cbb8f713922369bd027ce44d20937130deb558fe984b166dde1
- SSDEEP
  
  6144:BLLQWL3zntFj3OB0LPJQOZGhcvSSj2x+TGLNs3EtU7L:BQeFTOAQIacvSS6oqLFtsL
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2