emotet

General

Target

d2f88fb47c620e598694951674d0b946_JaffaCakes118
Size

424KB
Sample

240907-2gpgbsygkl
MD5

d2f88fb47c620e598694951674d0b946
SHA1

5f458a574e6193ecc3a9bdb4f256f2f141b4e788
SHA256

d671be996fc9de10b366f2374ebf56b6c4652027f94df3741ee02976e90d3009
SHA512

b662be2fc1cbbfea446659673f397a2b7ab3955cb385f86058ffbf276de242a8c416adb7aa6383e62c17c69452109ce710f10ee49b37c432657c5b37d2cd181c
SSDEEP

6144:4abhDkzV+z3ItUUiCFYcK/7X0XfGkDmrDI3h4KFzq+EP78YaAy2+1Oo:4YhozVKIixT7XFPc3KixEP7Z

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

12.163.208.58:80

45.33.35.74:8080

87.106.253.248:8080

192.241.146.84:8080

190.115.18.139:8080

65.36.62.20:80

170.81.48.2:80

83.169.21.32:7080

185.232.182.218:80

190.2.31.172:80

77.106.157.34:8080

82.230.1.24:80

202.4.58.197:80

201.213.177.139:80

78.249.119.122:80

123.51.47.18:80

77.90.136.129:8080

60.93.23.51:80

152.169.22.67:80

190.117.79.209:80

rsa_pubkey.plain

Targets

- Target
  
  d2f88fb47c620e598694951674d0b946_JaffaCakes118
- Size
  
  424KB
- MD5
  
  d2f88fb47c620e598694951674d0b946
- SHA1
  
  5f458a574e6193ecc3a9bdb4f256f2f141b4e788
- SHA256
  
  d671be996fc9de10b366f2374ebf56b6c4652027f94df3741ee02976e90d3009
- SHA512
  
  b662be2fc1cbbfea446659673f397a2b7ab3955cb385f86058ffbf276de242a8c416adb7aa6383e62c17c69452109ce710f10ee49b37c432657c5b37d2cd181c
- SSDEEP
  
  6144:4abhDkzV+z3ItUUiCFYcK/7X0XfGkDmrDI3h4KFzq+EP78YaAy2+1Oo:4YhozVKIixT7XFPc3KixEP7Z
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2