emotet

General

Target

2024-04-14_b307ba1e892e317dba7bb73cc9d4fe4b_icedid
Size

448KB
Sample

240414-k8svdsad8y
MD5

b307ba1e892e317dba7bb73cc9d4fe4b
SHA1

c4100b21b1c0dfad189a51bcb75732efda17d655
SHA256

4c80ac874fe04b44e6a1799bd3c10720c8d92c767e7f98945c5889928ad797ea
SHA512

5c3ec7abb282bc03327ebd60d46d19f7555e918530497bc231d3fcf77b2822bef8b3e2afe68ac954dad3892a983ea14d7f243a7f9b0d1f15725ce74454ad980b
SSDEEP

12288:bFBDSh9cQZ2ExstHDJ1PGnWUYzL2v+0JSmS:YzZtstHrGnTY+P

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

82.76.111.249:443

116.125.120.88:443

217.160.182.191:8080

189.1.185.98:8080

189.194.58.119:80

213.181.91.224:80

219.92.13.25:80

190.6.193.152:8080

61.92.159.208:8080

209.236.123.42:8080

12.162.84.2:8080

190.147.137.153:443

104.131.103.37:8080

212.231.60.98:80

202.62.39.111:80

82.240.207.95:443

170.81.48.2:80

177.74.228.34:80

82.196.15.205:8080

114.109.179.60:80

rsa_pubkey.plain

Targets

- Target
  
  2024-04-14_b307ba1e892e317dba7bb73cc9d4fe4b_icedid
- Size
  
  448KB
- MD5
  
  b307ba1e892e317dba7bb73cc9d4fe4b
- SHA1
  
  c4100b21b1c0dfad189a51bcb75732efda17d655
- SHA256
  
  4c80ac874fe04b44e6a1799bd3c10720c8d92c767e7f98945c5889928ad797ea
- SHA512
  
  5c3ec7abb282bc03327ebd60d46d19f7555e918530497bc231d3fcf77b2822bef8b3e2afe68ac954dad3892a983ea14d7f243a7f9b0d1f15725ce74454ad980b
- SSDEEP
  
  12288:bFBDSh9cQZ2ExstHDJ1PGnWUYzL2v+0JSmS:YzZtstHrGnTY+P
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2