emotet

General

Target

cbe304e6911bdef56c98ab8731054d2f_JaffaCakes118
Size

609KB
Sample

240830-3rzkqatanf
MD5

cbe304e6911bdef56c98ab8731054d2f
SHA1

4739d0f5d65fde07268d578235268e0950a4507a
SHA256

45c6a485f5ee6e4d6654941e5d4e8ad38fc89a057cc3b5bbaf6a58679e156848
SHA512

8101c265243f62e9e071b98086a47014ee16523bdac03f59442d4fe77a3ffeb5011cb4635e8a3e64671ca8dda8386187242985ca2e342e4bdd7a1772105af971
SSDEEP

12288:4YzchQVZnkmt/70MWugxPJZFpf0c1pHWbdJxUR9rNXZL4:L4KV5Hpt8bZHLKnM919

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

132.248.38.158:80

110.172.180.180:8080

70.32.89.105:8080

161.49.84.2:80

37.46.129.215:8080

50.116.78.109:8080

115.79.195.246:80

178.62.254.156:8080

175.103.38.146:80

188.226.165.170:8080

91.93.3.85:8080

162.144.145.58:8080

117.2.139.117:443

190.85.46.52:7080

201.193.160.196:80

152.32.75.74:443

195.201.56.70:8080

rsa_pubkey.plain

Targets

- Target
  
  cbe304e6911bdef56c98ab8731054d2f_JaffaCakes118
- Size
  
  609KB
- MD5
  
  cbe304e6911bdef56c98ab8731054d2f
- SHA1
  
  4739d0f5d65fde07268d578235268e0950a4507a
- SHA256
  
  45c6a485f5ee6e4d6654941e5d4e8ad38fc89a057cc3b5bbaf6a58679e156848
- SHA512
  
  8101c265243f62e9e071b98086a47014ee16523bdac03f59442d4fe77a3ffeb5011cb4635e8a3e64671ca8dda8386187242985ca2e342e4bdd7a1772105af971
- SSDEEP
  
  12288:4YzchQVZnkmt/70MWugxPJZFpf0c1pHWbdJxUR9rNXZL4:L4KV5Hpt8bZHLKnM919
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2