emotet

General

Target

025c2c3757f1b6afe018cbbad295c17e_JaffaCakes118
Size

236KB
Sample

240427-ee2ybaad78
MD5

025c2c3757f1b6afe018cbbad295c17e
SHA1

8fe57280e7c588dd571ab99bfafd2ca0d916f49d
SHA256

853d5165741a53413a174d7d369515d13f8547e2a5b7bc7490e06bf8278b9fa8
SHA512

e42c7c60db2373648cc9abc67b09d6c3e37880749c4c179961f2ea8d18bb027f26b51fe6c121b03938219401acbfc55de0b29641868b0183bae49c1d97ced667
SSDEEP

3072:2leEhMJDJDBwt65cJAVTT8xBtNk4DkUoerQBbrb1yqbgUnhvXcFk7ZBNmM4Q/Bj9:IZhMlJ96JAVGz4Sebf8qbgavcWVBNmM

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.113.69.136:80

51.38.124.206:80

82.196.15.205:8080

38.88.126.202:8080

190.115.18.139:8080

98.13.75.196:80

181.30.61.163:443

82.76.111.249:443

181.129.96.162:8080

74.58.215.226:80

68.69.155.181:80

188.135.15.49:80

190.163.31.26:80

50.121.220.50:80

51.159.23.217:443

2.47.112.152:80

185.215.227.107:443

217.13.106.14:8080

70.32.115.157:8080

170.81.48.2:80

rsa_pubkey.plain

Targets

- Target
  
  025c2c3757f1b6afe018cbbad295c17e_JaffaCakes118
- Size
  
  236KB
- MD5
  
  025c2c3757f1b6afe018cbbad295c17e
- SHA1
  
  8fe57280e7c588dd571ab99bfafd2ca0d916f49d
- SHA256
  
  853d5165741a53413a174d7d369515d13f8547e2a5b7bc7490e06bf8278b9fa8
- SHA512
  
  e42c7c60db2373648cc9abc67b09d6c3e37880749c4c179961f2ea8d18bb027f26b51fe6c121b03938219401acbfc55de0b29641868b0183bae49c1d97ced667
- SSDEEP
  
  3072:2leEhMJDJDBwt65cJAVTT8xBtNk4DkUoerQBbrb1yqbgUnhvXcFk7ZBNmM4Q/Bj9:IZhMlJ96JAVGz4Sebf8qbgavcWVBNmM
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2