emotet

General

Target

d31c84eff5e0606b588978c4f88ec93e_JaffaCakes118
Size

340KB
Sample

240908-ad1awashkl
MD5

d31c84eff5e0606b588978c4f88ec93e
SHA1

d6ea72a85411857c2152cbbfd19c0aeae7b0e21c
SHA256

9a51efdea59d068b215669f273f5d095b75df8010aae1c6fc9e97391323a8b81
SHA512

bcd86153619d4d3a7498ec4163336a6d90cef2e7f627ca52b02ecfaa1477eed2a48e4859c04f3a9daa04dfe17d7448b7fb51b6c98843df5b62a1da4594734fd2
SSDEEP

3072:tvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:t206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Targets

- Target
  
  d31c84eff5e0606b588978c4f88ec93e_JaffaCakes118
- Size
  
  340KB
- MD5
  
  d31c84eff5e0606b588978c4f88ec93e
- SHA1
  
  d6ea72a85411857c2152cbbfd19c0aeae7b0e21c
- SHA256
  
  9a51efdea59d068b215669f273f5d095b75df8010aae1c6fc9e97391323a8b81
- SHA512
  
  bcd86153619d4d3a7498ec4163336a6d90cef2e7f627ca52b02ecfaa1477eed2a48e4859c04f3a9daa04dfe17d7448b7fb51b6c98843df5b62a1da4594734fd2
- SSDEEP
  
  3072:tvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:t206xWgGxLxWN40PDKR/JnX2P
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2