emotet

Sharing

Copy URL Twitter E-mail

General

Target
985799e66581ef777b52da4338130e6c_JaffaCakes118
Size 532KB
Sample240605-rbdsjaaa45
SHA256 7921e0e1f73e08021aa0648c408f236cdc483fb187d19e7a5651c08f05d9dd3b
MD5 985799e66581ef777b52da4338130e6c
SHA1 c9b37102c09db351e30f7dcefedd2821692d7026
SHA512 7035ddfd52ca208a2dd9dfa639756985688b557bd68d89c12e3ee7939102ba8df93e195b35d73cbac0021ff2ef98ed3619dd3a60edb049a5b8fe79fc55f67013
SSDEEP 6144:7hWh0YI1DsdsLZQ+cUZb8XcBhC5Yp9PHS6pKNJJrF+H3lV/+ZDCE6B2Gh/nNfOf8:7he0wsfcU50RAVUPJrFm+kfh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

201.184.105.242:443
24.45.195.162:7080
24.45.195.162:8443
94.192.225.46:80
80.11.163.139:443
133.167.80.63:7080
198.199.114.69:8080
80.79.23.144:443
192.254.173.31:8080
67.225.229.55:8080
190.108.228.48:990
62.75.187.192:8080
185.94.252.13:443
94.205.247.10:80
211.63.71.72:8080
59.103.164.174:80
192.81.213.192:8080
27.4.80.183:443
190.145.67.134:8090
115.78.95.230:443
104.131.11.150:8080
95.128.43.213:8080
212.71.234.16:8080
178.254.6.27:7080
86.98.25.30:53
91.205.215.66:8080
188.166.253.46:8080
80.11.163.139:21
186.75.241.230:80
190.106.97.230:443
78.24.219.147:8080
217.160.182.191:8080
173.212.203.26:8080
92.222.216.44:8080
136.243.177.26:8080
37.157.194.134:443
190.211.207.11:443
104.236.246.93:8080
190.18.146.70:80
103.255.150.84:80
138.201.140.110:8080
41.220.119.246:80
200.71.148.138:8080
85.54.169.141:8080
144.139.247.220:80
149.202.153.252:8080
31.172.240.91:8080
186.4.172.5:443
178.79.161.166:443
186.4.172.5:8080
206.189.98.125:8080
87.106.139.101:8080
46.105.131.87:80
45.123.3.54:443
222.214.218.192:8080
85.106.1.166:50000
83.136.245.190:8080
179.32.19.219:22
152.89.236.214:8080
181.31.213.158:8080
87.106.136.232:8080
47.41.213.2:22
201.251.43.69:8080
24.51.106.145:21
87.230.19.21:8080
190.228.72.244:53
181.143.194.138:443
182.176.106.43:995
31.12.67.62:7080
182.76.6.2:8080
190.226.44.20:21
181.143.53.227:21
189.209.217.49:80
190.186.203.55:80
27.147.163.188:8080
159.65.25.128:8080
101.187.237.217:20
182.176.132.213:8090
199.19.237.192:80
124.240.198.66:80
5.196.74.210:8080
190.53.135.159:21
186.4.172.5:20
45.33.49.124:443
92.233.128.13:143
85.104.59.244:20
169.239.182.217:8080

rsa_pubkey.plain

Targets

- Target
  985799e66581ef777b52da4338130e6c_JaffaCakes118
- Size 532KB
- SHA256 7921e0e1f73e08021aa0648c408f236cdc483fb187d19e7a5651c08f05d9dd3b
- MD5 985799e66581ef777b52da4338130e6c
- SHA1 c9b37102c09db351e30f7dcefedd2821692d7026
- SHA512 7035ddfd52ca208a2dd9dfa639756985688b557bd68d89c12e3ee7939102ba8df93e195b35d73cbac0021ff2ef98ed3619dd3a60edb049a5b8fe79fc55f67013
- SSDEEP 6144:7hWh0YI1DsdsLZQ+cUZb8XcBhC5Yp9PHS6pKNJJrF+H3lV/+ZDCE6B2Gh/nNfOf8:7he0wsfcU50RAVUPJrFm+kfh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2