emotet

General

Target

0166b94d550cef44cd2cf01699716927_JaffaCakes118
Size

104KB
Sample

240426-w7twvahf53
MD5

0166b94d550cef44cd2cf01699716927
SHA1

1420b54a705074ffb3d5f91aa4a06bbcbc3bc307
SHA256

011388a47db360ac0943aac87c6e53d1a8f74798e446b72ad777f0211c6b06a9
SHA512

58657475f68abb926017dfb4b06de212b778595519c418133f8efb18b0c839e38f837ab297c2c90c8ede0c813881c8da612ac652c6e2178d04f6dcad66dc929c
SSDEEP

3072:iNOlUI7W7YGweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIynwev5ddGNVe49M7Lm

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

115.176.16.221:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

180.26.62.115:443

179.5.118.12:80

189.160.188.97:80

5.79.70.250:8080

126.126.139.26:443

41.84.243.145:80

79.133.6.236:8080

139.59.12.63:8080

95.216.205.155:8080

45.177.120.37:8080

54.38.143.245:8080

157.7.164.178:8081

41.212.89.128:80

50.116.78.109:8080

75.127.14.170:8080

49.243.9.118:80

rsa_pubkey.plain

Targets

- Target
  
  0166b94d550cef44cd2cf01699716927_JaffaCakes118
- Size
  
  104KB
- MD5
  
  0166b94d550cef44cd2cf01699716927
- SHA1
  
  1420b54a705074ffb3d5f91aa4a06bbcbc3bc307
- SHA256
  
  011388a47db360ac0943aac87c6e53d1a8f74798e446b72ad777f0211c6b06a9
- SHA512
  
  58657475f68abb926017dfb4b06de212b778595519c418133f8efb18b0c839e38f837ab297c2c90c8ede0c813881c8da612ac652c6e2178d04f6dcad66dc929c
- SSDEEP
  
  3072:iNOlUI7W7YGweSGXAhg5domGX9LpV049iBVBJ53Mj:AwUIynwev5ddGNVe49M7Lm
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2