emotet

General

Target

cf1071b6c53f8c1ba7c636689241b59c_JaffaCakes118
Size

168KB
Sample

240906-jwvb1svhlc
MD5

cf1071b6c53f8c1ba7c636689241b59c
SHA1

e6c2503ab83878fe57515e1613b1d75bd41f04a0
SHA256

51e2e0b69775a114c964a6dee3618c3bbc90019fe372efd55316066b1f0bb90a
SHA512

1d2998f4c89bc72b89080a8b5aa0535fa57d1f8d56e65a4b271f6b12b22baba39e7915657b486cedb5e84f989e23114d510b46f8a047e7c9fab96d643fbd44f1
SSDEEP

3072:Q6QL5LhoNlLVG4EGZE3kgxAm/oE7CJ/ogu1pMQWqNgL4xuEQsxq:iLYkZ3kgCkkowQWqi6LQ

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

183.77.227.38:80

45.177.120.36:80

162.241.41.111:7080

190.85.46.52:7080

54.38.143.245:8080

139.59.61.215:443

202.166.170.43:80

37.46.129.215:8080

120.51.34.254:80

113.160.248.110:80

27.73.70.219:8080

46.105.131.68:8080

88.247.58.26:80

46.32.229.152:8080

195.201.56.70:8080

93.20.157.143:80

103.48.68.173:80

167.71.227.113:8080

8.4.9.137:8080

172.96.190.154:8080

rsa_pubkey.plain

Targets

- Target
  
  cf1071b6c53f8c1ba7c636689241b59c_JaffaCakes118
- Size
  
  168KB
- MD5
  
  cf1071b6c53f8c1ba7c636689241b59c
- SHA1
  
  e6c2503ab83878fe57515e1613b1d75bd41f04a0
- SHA256
  
  51e2e0b69775a114c964a6dee3618c3bbc90019fe372efd55316066b1f0bb90a
- SHA512
  
  1d2998f4c89bc72b89080a8b5aa0535fa57d1f8d56e65a4b271f6b12b22baba39e7915657b486cedb5e84f989e23114d510b46f8a047e7c9fab96d643fbd44f1
- SSDEEP
  
  3072:Q6QL5LhoNlLVG4EGZE3kgxAm/oE7CJ/ogu1pMQWqNgL4xuEQsxq:iLYkZ3kgCkkowQWqi6LQ
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2