emotet

General

Target

02758b67b14376513986057a4220046f_JaffaCakes118
Size

448KB
Sample

240427-ffae5acb6v
MD5

02758b67b14376513986057a4220046f
SHA1

1aa0a070621d544d4d98795d96c2121ced23f475
SHA256

b90c134581642a96f7f6be1b7a8ac33df7f92eb9e5149f81583eaff702906ece
SHA512

be3901b1870a7a53ecff0c85f13ef7b06feb6f2c6921c727c78e90fa7b3f1b0ebe90e23c07d42d38d4657d61732f74e8f69d5c8fb034dd1c6f13434058528a92
SSDEEP

12288:EfzaBuiszJbE9mO4sl9kHAOyQkNvOzxr:EbMmO4sl9gR2Ot

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

71.57.180.213:80

185.86.148.68:443

168.235.82.183:8080

181.113.229.139:443

181.134.9.162:80

217.199.160.224:8080

105.209.235.113:8080

216.75.37.196:8080

97.104.107.190:80

203.153.216.182:7080

107.161.30.122:8080

41.106.96.12:80

202.5.47.71:80

201.235.10.215:80

105.213.67.88:80

115.79.195.246:80

179.5.118.12:80

212.112.113.235:80

139.59.12.63:8080

177.37.81.212:443

rsa_pubkey.plain

Targets

- Target
  
  02758b67b14376513986057a4220046f_JaffaCakes118
- Size
  
  448KB
- MD5
  
  02758b67b14376513986057a4220046f
- SHA1
  
  1aa0a070621d544d4d98795d96c2121ced23f475
- SHA256
  
  b90c134581642a96f7f6be1b7a8ac33df7f92eb9e5149f81583eaff702906ece
- SHA512
  
  be3901b1870a7a53ecff0c85f13ef7b06feb6f2c6921c727c78e90fa7b3f1b0ebe90e23c07d42d38d4657d61732f74e8f69d5c8fb034dd1c6f13434058528a92
- SSDEEP
  
  12288:EfzaBuiszJbE9mO4sl9kHAOyQkNvOzxr:EbMmO4sl9gR2Ot
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2