emotet

General

Target

2024-04-13_5b7d91515a4b65d243ef074eac657505_icedid
Size

273KB
Sample

240413-ebd23sbb53
MD5

5b7d91515a4b65d243ef074eac657505
SHA1

8a2928272ac430bbc69bf4634dc089c87a1f3200
SHA256

e9973029a4b7112be1c157ce1c60439bff0d5aaa1d61728e42e2347ce69baff7
SHA512

744505a1baabd627f46a90f7768cdc2f7c708615a5adca8f4fca77de30e5147f468f1e368303f865b1a034a0f244fafb709e7afc38e56478c2bf12d6a2055ca8
SSDEEP

6144:aGj5A9/6y8mGw8jArXM1qa9fjLI/cywmYYdxxx:aG9sgjALM1qYCcVwxH

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

109.117.53.230:443

212.51.142.238:8080

190.160.53.126:80

139.59.60.244:8080

91.211.88.52:7080

190.108.228.62:443

186.208.123.210:443

46.105.131.87:80

173.91.22.41:80

222.214.218.37:4143

31.31.77.83:443

62.75.141.82:80

93.156.165.186:80

93.51.50.171:8080

185.94.252.104:443

78.189.165.52:8080

95.179.229.244:8080

73.11.153.178:8080

203.153.216.189:7080

95.213.236.64:8080

rsa_pubkey.plain

Targets

- Target
  
  2024-04-13_5b7d91515a4b65d243ef074eac657505_icedid
- Size
  
  273KB
- MD5
  
  5b7d91515a4b65d243ef074eac657505
- SHA1
  
  8a2928272ac430bbc69bf4634dc089c87a1f3200
- SHA256
  
  e9973029a4b7112be1c157ce1c60439bff0d5aaa1d61728e42e2347ce69baff7
- SHA512
  
  744505a1baabd627f46a90f7768cdc2f7c708615a5adca8f4fca77de30e5147f468f1e368303f865b1a034a0f244fafb709e7afc38e56478c2bf12d6a2055ca8
- SSDEEP
  
  6144:aGj5A9/6y8mGw8jArXM1qa9fjLI/cywmYYdxxx:aG9sgjALM1qYCcVwxH
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2