emotet

General

Target

UltraDropper.exe
Size

60KB
Sample

240616-qkxrbsvcke
MD5

7d4fe74a0de427b425f44645fdfe9701
SHA1

05ae386057b54eb0f518e8e4f82d416f0ad0d880
SHA256

5d3305ba49b8572e46236fe824d4659d474ece024adcd724f380a9abbfb5c452
SHA512

f10e4341517c6c0571397b86585fc165aec8f6aa54fec4f8408e1f56ac4ddd7537750ab323365dc8e474aa09b1fe4516d70edfb5ef62bec064f7f85b5d9d03c3
SSDEEP

768:D1TVoC2Os3klvq3fqFNcmP1pNv34KObs3FalxTqOf70QuVORH:DxVs5favbCs3FUwu70QuVs

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/myupdate.exe

Targets

- Target
  
  UltraDropper.exe
- Size
  
  60KB
- MD5
  
  7d4fe74a0de427b425f44645fdfe9701
- SHA1
  
  05ae386057b54eb0f518e8e4f82d416f0ad0d880
- SHA256
  
  5d3305ba49b8572e46236fe824d4659d474ece024adcd724f380a9abbfb5c452
- SHA512
  
  f10e4341517c6c0571397b86585fc165aec8f6aa54fec4f8408e1f56ac4ddd7537750ab323365dc8e474aa09b1fe4516d70edfb5ef62bec064f7f85b5d9d03c3
- SSDEEP
  
  768:D1TVoC2Os3klvq3fqFNcmP1pNv34KObs3FalxTqOf70QuVORH:DxVs5favbCs3FUwu70QuVs
Score

10^/10

emotet eternity privateloader risepro epoch5 banker bootkit discovery evasion loader persistence spyware stealer trojan upx
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1