emotet

Sharing

Copy URL Twitter E-mail

General

Target
a0a6725a6fc965d7c8ac2fc0342e57f9_JaffaCakes118
Size 468KB
Sample240612-ph2f3avbld
SHA256 c5d42d453dbc3a400b3f1a91abc2fc6cc621381819aa1d6bfbe399127d382beb
MD5 a0a6725a6fc965d7c8ac2fc0342e57f9
SHA1 c3ee258bf7833c8de671b3702a4c70729f2ed4e0
SHA512 09606c83ffdf422d1afedf6c68d593cbc66939cdd4dff9248f6281fe6d93ea947b081c673c5c3bb32952e755950440c8ff051e14780dd0ec26ee1d60db026af0
SSDEEP 6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZ4fiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZ41SR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

172.91.208.86:80
45.55.36.51:443
91.83.93.99:7080
45.55.219.163:443
107.5.122.110:80
103.86.49.11:8080
85.105.205.77:8080
120.150.60.189:80
137.59.187.107:8080
139.59.60.244:8080
203.117.253.142:80
1.221.254.82:80
97.82.79.83:80
37.187.72.193:8080
139.99.158.11:443
152.168.248.128:443
74.208.45.104:8080
83.169.36.251:8080
169.239.182.217:8080
216.208.76.186:80
209.141.54.221:8080
78.24.219.147:8080
104.131.44.150:8080
68.171.118.7:80
137.119.36.33:80
109.74.5.95:8080
84.39.182.7:80
157.147.76.151:80
95.179.229.244:8080
174.102.48.180:443
194.187.133.160:443
201.173.217.124:443
187.161.206.24:80
70.121.172.89:80
61.19.246.238:443
181.230.116.163:80
47.146.117.214:80
112.185.64.233:80
174.45.13.118:80
85.66.181.138:80
189.212.199.126:443
190.160.53.126:80
46.105.131.79:8080
173.81.218.65:80
24.179.13.119:80
37.139.21.175:8080
87.106.139.101:8080
110.145.77.103:80
200.41.121.90:80
185.94.252.104:443
104.131.11.150:443
157.245.99.39:8080
37.70.8.161:80
167.86.90.214:8080
153.232.188.106:80
121.124.124.40:7080
5.196.74.210:8080
113.160.130.116:8443
87.106.136.232:8080
41.60.200.34:80
74.120.55.163:80
24.43.99.75:80
95.213.236.64:8080
98.109.204.230:80
204.197.146.48:80
62.75.141.82:80
68.188.112.97:80
203.153.216.189:7080
91.211.88.52:7080
24.137.76.62:80
75.139.38.211:80
168.235.67.138:7080
190.55.181.54:443
67.205.85.243:8080
94.200.114.161:80
139.162.108.71:8080
47.144.21.12:443
104.236.246.93:8080
5.39.91.110:7080
69.30.203.214:8080
74.109.108.202:80
176.111.60.55:8080
139.130.242.43:80
94.23.237.171:443
174.137.65.18:80
85.152.162.105:80
93.147.212.206:80
200.114.213.233:8080
180.92.239.110:8080
173.62.217.22:443
62.30.7.67:443
79.98.24.39:8080
188.219.31.12:80

rsa_pubkey.plain

Targets

- Target
  a0a6725a6fc965d7c8ac2fc0342e57f9_JaffaCakes118
- Size 468KB
- SHA256 c5d42d453dbc3a400b3f1a91abc2fc6cc621381819aa1d6bfbe399127d382beb
- MD5 a0a6725a6fc965d7c8ac2fc0342e57f9
- SHA1 c3ee258bf7833c8de671b3702a4c70729f2ed4e0
- SHA512 09606c83ffdf422d1afedf6c68d593cbc66939cdd4dff9248f6281fe6d93ea947b081c673c5c3bb32952e755950440c8ff051e14780dd0ec26ee1d60db026af0
- SSDEEP 6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZ4fiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZ41SR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

emotet epoch2 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks