emotet

Sharing

Copy URL Twitter E-mail

General

Target
b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118
Size 408KB
Sample240616-fl7b2svblk
SHA256 1835d834555dc234695dce408bbcbe16fe8b22ff25e01a2a6e2c4428e30b7758
MD5 b1d39ceff7e57ec494348822a29e4a74
SHA1 9422d78bdb2c68ef8322deb2d5cd10ada7a177fb
SHA512 320c8bbd8c2e95ba2b5f131acd3ca2e14fe7db84d4cc6926fd806763387337ce94624226f312d83864f1f2e9124d3ddaef26ee0e47278e2c2584672b310f09d7
SSDEEP 6144:3nOIweNcFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweN0e1yOfH8sEQSs2ax
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

128.92.203.42:80
37.187.161.206:8080
202.29.239.162:443
80.87.201.221:7080
190.188.245.242:80
12.163.208.58:80
213.197.182.158:8080
201.213.177.139:80
62.84.75.50:80
45.33.77.42:8080
185.183.16.47:80
78.249.119.122:80
177.129.17.170:443
51.15.7.189:80
152.169.22.67:80
119.106.216.84:80
109.169.12.78:80
51.15.7.145:80
219.92.13.25:80
190.117.79.209:80
35.143.99.174:80
51.255.165.160:8080
209.236.123.42:8080
70.32.115.157:8080
155.186.0.121:80
177.73.0.98:443
181.129.96.162:8080
45.46.37.97:80
178.250.54.208:8080
68.183.170.114:8080
51.38.124.206:80
203.205.28.68:80
46.43.2.95:8080
65.36.62.20:80
70.116.143.84:80
5.189.178.202:8080
190.115.18.139:8080
74.58.215.226:80
185.94.252.12:80
51.75.33.127:80
190.190.148.27:8080
82.76.111.249:443
137.74.106.111:7080
85.214.26.7:8080
76.168.54.203:80
60.93.23.51:80
188.135.15.49:80
186.103.141.250:443
202.134.4.210:7080
185.232.182.218:80
104.131.41.185:8080
123.51.47.18:80
217.13.106.14:8080
116.202.23.3:8080
186.70.127.199:8090
94.176.234.118:443
5.196.35.138:7080
216.47.196.104:80
96.227.52.8:443
191.182.6.118:80
174.113.69.136:80
87.106.253.248:8080
192.241.146.84:8080
190.24.243.186:80
68.183.190.199:8080
12.162.84.2:8080
189.2.177.210:443
98.13.75.196:80
185.94.252.27:443
64.201.88.132:80
149.202.72.142:7080
172.104.169.32:8080
181.74.0.251:80
87.106.46.107:8080
60.108.144.104:443
170.81.48.2:80
67.247.242.247:80
212.71.237.140:8080
202.4.58.197:80
189.35.44.221:80
138.97.60.141:7080
50.121.220.50:80
2.36.95.106:80
177.74.228.34:80
83.169.21.32:7080
111.67.12.221:8080
192.81.38.31:80
70.169.17.134:80
77.238.212.227:80
61.197.92.216:80
82.230.1.24:80
95.9.180.128:80
50.28.51.143:8080
70.32.84.74:8080
1.226.84.243:8080
192.241.143.52:8080
181.30.61.163:443
74.136.144.133:80
45.33.35.74:8080

rsa_pubkey.plain

Targets

- Target
  b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118
- Size 408KB
- SHA256 1835d834555dc234695dce408bbcbe16fe8b22ff25e01a2a6e2c4428e30b7758
- MD5 b1d39ceff7e57ec494348822a29e4a74
- SHA1 9422d78bdb2c68ef8322deb2d5cd10ada7a177fb
- SHA512 320c8bbd8c2e95ba2b5f131acd3ca2e14fe7db84d4cc6926fd806763387337ce94624226f312d83864f1f2e9124d3ddaef26ee0e47278e2c2584672b310f09d7
- SSDEEP 6144:3nOIweNcFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweN0e1yOfH8sEQSs2ax
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2