emotet

General

Target

5638c67a0d982912e24034cf07db35b31bf90faab98f7f833dbc4417a87fe9e4
Size

283KB
Sample

240417-qlt2tshb79
MD5

ec07fb3fdbbde3a65423d47c6fd5b4d9
SHA1

f8fe4aebbc33306752e665944ab4526937804c56
SHA256

5638c67a0d982912e24034cf07db35b31bf90faab98f7f833dbc4417a87fe9e4
SHA512

d30f17540d4402197f6394b4219853fc79e5016907c3f1f005d5ee515f5cd64e44c69a8ccae8a6434ebee97addca48afeadbb370d39db7696a63b7901431539f
SSDEEP

6144:LSSr/csaVDTIEJ17WIhxIbk+fd+pFKf8iEJL8MDV2YehFu2YpsWEV:L/cJtdJzII+fj+JLb/6Fu2Y6WK

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20

rsa_pubkey.plain

Targets

- Target
  
  7bdd1409b080eb8510163cea3761d694be0eaec7e22bc44736cbfbc3025a310b.exe
- Size
  
  540KB
- MD5
  
  28cfd8a6b63836e39fc10c87ee7ec59d
- SHA1
  
  7ace13d7b698ca6fa87ef337237893424503bde7
- SHA256
  
  7bdd1409b080eb8510163cea3761d694be0eaec7e22bc44736cbfbc3025a310b
- SHA512
  
  0de6451ccbc936e3eebead59447ea803a012b8774d7622a9822d59cfab1400ce0345da8cfb729c76a3b4fc1cd5775183e0a43289a5f428a31bb86ddf91718862
- SSDEEP
  
  12288:ry5iow33myVaf/mhy4h0gTLL/niHDpWuOthr+RMp:6i/Hm6xhyLgHrni0H
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2