emotet

General

Target

2f80661e9cc870c5e9520ba97d9d6070N.exe
Size

838KB
Sample

240905-ht1wcawdrf
MD5

2f80661e9cc870c5e9520ba97d9d6070
SHA1

8c6d0b40143478a0e25c413ecc8bc8b1ef548807
SHA256

cddc91cfcc8a9ffa98863c3dd07caac45c00142125e82eaf40e64e8cfac670bf
SHA512

06b1a0f8e630e0a0fe4c04812cba6780ba449c1f50a6856e209b87d8c6eab560671627ef757fef48b0712bd99f16a667beb2f5901e9c02e5430e617d18482df1
SSDEEP

12288:wZFfm9WYbWeR2XIl04x8nAPMDWpRvgOhIYWbu7xwT7fH6vueOfc3O:qM9WYL3ioIkgOhIYEf6vueOfc

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

85.246.78.192:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

175.103.38.146:80

192.210.217.94:8080

180.23.53.200:80

202.29.237.113:8080

58.27.215.3:8080

190.85.46.52:7080

36.91.44.183:80

190.164.135.81:80

37.205.9.252:7080

192.241.220.183:8080

5.2.246.108:80

180.21.3.52:80

85.75.49.113:80

190.55.186.229:80

116.91.240.96:80

180.148.4.130:8080

rsa_pubkey.plain

Targets

- Target
  
  2f80661e9cc870c5e9520ba97d9d6070N.exe
- Size
  
  838KB
- MD5
  
  2f80661e9cc870c5e9520ba97d9d6070
- SHA1
  
  8c6d0b40143478a0e25c413ecc8bc8b1ef548807
- SHA256
  
  cddc91cfcc8a9ffa98863c3dd07caac45c00142125e82eaf40e64e8cfac670bf
- SHA512
  
  06b1a0f8e630e0a0fe4c04812cba6780ba449c1f50a6856e209b87d8c6eab560671627ef757fef48b0712bd99f16a667beb2f5901e9c02e5430e617d18482df1
- SSDEEP
  
  12288:wZFfm9WYbWeR2XIl04x8nAPMDWpRvgOhIYWbu7xwT7fH6vueOfc3O:qM9WYL3ioIkgOhIYEf6vueOfc
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2