emotet

General

Target

d226ff9f8be818bea5cfef3007ce6c3e_JaffaCakes118
Size

268KB
Sample

240907-rty67ayckr
MD5

d226ff9f8be818bea5cfef3007ce6c3e
SHA1

94900c1b24b03f087206b78e99fde0b1ee9eaf0e
SHA256

b66e5aebe38403fee593e1fe0d85513bfd688b926d762c618fce5864821f400c
SHA512

89122d8d0a936fe073f074aed256a22a5e662ac31597936f4b257e55f28333f409b122583340fcbf94ef268cbdff64939038c9826c3ada4971e68a2b3a346858
SSDEEP

3072:iJ64dCfmyfm89HofYh4Cdx3/mMHoed8X1OBeUgR6zEHYBhMrDNelZc/d:i0mSmcS+LP/yR1c4YkKK

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Targets

- Target
  
  d226ff9f8be818bea5cfef3007ce6c3e_JaffaCakes118
- Size
  
  268KB
- MD5
  
  d226ff9f8be818bea5cfef3007ce6c3e
- SHA1
  
  94900c1b24b03f087206b78e99fde0b1ee9eaf0e
- SHA256
  
  b66e5aebe38403fee593e1fe0d85513bfd688b926d762c618fce5864821f400c
- SHA512
  
  89122d8d0a936fe073f074aed256a22a5e662ac31597936f4b257e55f28333f409b122583340fcbf94ef268cbdff64939038c9826c3ada4971e68a2b3a346858
- SSDEEP
  
  3072:iJ64dCfmyfm89HofYh4Cdx3/mMHoed8X1OBeUgR6zEHYBhMrDNelZc/d:i0mSmcS+LP/yR1c4YkKK
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2