emotet

General

Target

01738048f2a1a57ad742fcb229321863_JaffaCakes118
Size

112KB
Sample

240426-xqt1ysab33
MD5

01738048f2a1a57ad742fcb229321863
SHA1

a55a6f0ec3703b6cc685d2245cf1eb6f1f6a54d8
SHA256

0999942f3df97b6c6d008d49828919738a261c798667ae1cdcf3825e2e0c417b
SHA512

4a0f19d9f03e189d9a1e767ed0eee38d3b04e26552bae8530376188ef7bd339fac506660e8bc7c12f230f65f0dff99399a2e5a183ddb44bd68f21133b33d87ed
SSDEEP

1536:Yzie/tPYOypPHtHUtSCSehr340YJ7bZ1oUZ5cRUdtyh7uxtFwNeE2IOpC:YGeVPYOgtHUtrR00OcENdtyhEkNZ24

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.192.39.136:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

190.190.15.20:80

181.95.133.104:80

41.212.89.128:80

115.176.16.221:80

143.95.101.72:8080

75.127.14.170:8080

116.202.10.123:8080

74.208.173.91:8080

103.93.220.182:80

50.116.78.109:8080

67.121.104.51:20

180.26.62.115:443

139.59.12.63:8080

76.18.16.210:80

113.161.148.81:80

5.79.70.250:8080

rsa_pubkey.plain

Targets

- Target
  
  01738048f2a1a57ad742fcb229321863_JaffaCakes118
- Size
  
  112KB
- MD5
  
  01738048f2a1a57ad742fcb229321863
- SHA1
  
  a55a6f0ec3703b6cc685d2245cf1eb6f1f6a54d8
- SHA256
  
  0999942f3df97b6c6d008d49828919738a261c798667ae1cdcf3825e2e0c417b
- SHA512
  
  4a0f19d9f03e189d9a1e767ed0eee38d3b04e26552bae8530376188ef7bd339fac506660e8bc7c12f230f65f0dff99399a2e5a183ddb44bd68f21133b33d87ed
- SSDEEP
  
  1536:Yzie/tPYOypPHtHUtSCSehr340YJ7bZ1oUZ5cRUdtyh7uxtFwNeE2IOpC:YGeVPYOgtHUtrR00OcENdtyhEkNZ24
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2