emotet

General

Target

010e81c2b79d1c58215ae94412378df8_JaffaCakes118
Size

104KB
Sample

240426-sn5mfsec58
MD5

010e81c2b79d1c58215ae94412378df8
SHA1

10608b43019bed12b5592041c0e1dd57e6087b00
SHA256

e5f6bdd09497595c48598842d93864c82be108ef96134a84a03ed7a4c749de8e
SHA512

478df296282f48402309367d67d6884b1fd1d5edff043afdb7a784c96ea2a43584ca5aa00de943e85a89ede5dc039452a08711df56523293145e1da458ab1088
SSDEEP

3072:iNOlUI7W7YdweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIywwev5ddGNVe49M7Lm

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

115.176.16.221:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

180.26.62.115:443

179.5.118.12:80

189.160.188.97:80

5.79.70.250:8080

126.126.139.26:443

41.84.243.145:80

79.133.6.236:8080

139.59.12.63:8080

95.216.205.155:8080

45.177.120.37:8080

54.38.143.245:8080

157.7.164.178:8081

41.212.89.128:80

50.116.78.109:8080

75.127.14.170:8080

49.243.9.118:80

rsa_pubkey.plain

Targets

- Target
  
  010e81c2b79d1c58215ae94412378df8_JaffaCakes118
- Size
  
  104KB
- MD5
  
  010e81c2b79d1c58215ae94412378df8
- SHA1
  
  10608b43019bed12b5592041c0e1dd57e6087b00
- SHA256
  
  e5f6bdd09497595c48598842d93864c82be108ef96134a84a03ed7a4c749de8e
- SHA512
  
  478df296282f48402309367d67d6884b1fd1d5edff043afdb7a784c96ea2a43584ca5aa00de943e85a89ede5dc039452a08711df56523293145e1da458ab1088
- SSDEEP
  
  3072:iNOlUI7W7YdweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIywwev5ddGNVe49M7Lm
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2