emotet

General

Target

093d18a99b5005fab2c16b79485b8bae_JaffaCakes118
Size

737KB
Sample

240430-g8zq6aeh9x
MD5

093d18a99b5005fab2c16b79485b8bae
SHA1

fe9087d04ff3aca26f88b342293fa97a1f358b01
SHA256

5d5642d30e04c2876f9c4577f9034dad4f6e32d3c37bf107b8e3dcd51b98aa49
SHA512

5c75e5fd33e5bebdf3e7a2b29c8d83e114c954538b21c9d36aa7df94546613d0408d9112ea2dc1da0a9620ed097ede219d95880c45048c0f3a42e80fbe39b995
SSDEEP

12288:nPjbJqzWBTK2X92LCL4tgIPr7PGymXadkYu7xvUwxnxfA7gHrs8OGgvmWKlEzgKg:rKgaCctgITJmXa67xJxnxn48OGgvmWdo

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.234.133.205:80

212.51.142.238:8080

37.139.21.175:8080

74.208.45.104:8080

137.59.187.107:8080

37.187.72.193:8080

189.212.199.126:443

153.126.210.205:7080

81.2.235.111:8080

108.26.231.214:80

62.75.141.82:80

61.19.246.238:443

104.131.11.150:443

24.1.189.87:8080

87.106.139.101:8080

190.160.53.126:80

209.182.216.177:443

104.131.44.150:8080

95.179.229.244:8080

71.208.216.10:80

rsa_pubkey.plain

Targets

- Target
  
  093d18a99b5005fab2c16b79485b8bae_JaffaCakes118
- Size
  
  737KB
- MD5
  
  093d18a99b5005fab2c16b79485b8bae
- SHA1
  
  fe9087d04ff3aca26f88b342293fa97a1f358b01
- SHA256
  
  5d5642d30e04c2876f9c4577f9034dad4f6e32d3c37bf107b8e3dcd51b98aa49
- SHA512
  
  5c75e5fd33e5bebdf3e7a2b29c8d83e114c954538b21c9d36aa7df94546613d0408d9112ea2dc1da0a9620ed097ede219d95880c45048c0f3a42e80fbe39b995
- SSDEEP
  
  12288:nPjbJqzWBTK2X92LCL4tgIPr7PGymXadkYu7xvUwxnxfA7gHrs8OGgvmWKlEzgKg:rKgaCctgITJmXa67xJxnxn48OGgvmWdo
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2