emotet

General

Target

d357d86410605403e7250cd57e2dcc4d_JaffaCakes118
Size

632KB
Sample

240908-c49ncaserh
MD5

d357d86410605403e7250cd57e2dcc4d
SHA1

902980f7f7770f906a3cd04b68fd366be49fc3c3
SHA256

10f9fd145a614510e655fb0d6fd267e55143baeea075a6ea25026cebe39e2f33
SHA512

ae3c2595e1243e6e87a3c105777697e98f9dad1aba5aa1aea8b47acd89497d982db6df0e774cbd153809002808e6018dacac8f15df8cd60cff370a70caaf87f1
SSDEEP

6144:uHbk/udeFz5BK21sDmulV8WLuX5TL5TV8snjNXkBu6wnPFHXXjneUPVEGkowvhOl:uHA/uKq21xWLu758sRo0FHXXlC9IQQ

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

98.13.75.196:80

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

212.71.237.140:8080

51.255.165.160:8080

188.135.15.49:80

189.2.177.210:443

45.161.242.102:80

72.167.223.217:8080

77.238.212.227:80

186.70.127.199:8090

45.33.77.42:8080

87.106.46.107:8080

172.104.169.32:8080

187.162.248.237:80

190.163.31.26:80

95.9.180.128:80

71.197.211.156:80

91.219.169.180:80

rsa_pubkey.plain

Targets

- Target
  
  d357d86410605403e7250cd57e2dcc4d_JaffaCakes118
- Size
  
  632KB
- MD5
  
  d357d86410605403e7250cd57e2dcc4d
- SHA1
  
  902980f7f7770f906a3cd04b68fd366be49fc3c3
- SHA256
  
  10f9fd145a614510e655fb0d6fd267e55143baeea075a6ea25026cebe39e2f33
- SHA512
  
  ae3c2595e1243e6e87a3c105777697e98f9dad1aba5aa1aea8b47acd89497d982db6df0e774cbd153809002808e6018dacac8f15df8cd60cff370a70caaf87f1
- SSDEEP
  
  6144:uHbk/udeFz5BK21sDmulV8WLuX5TL5TV8snjNXkBu6wnPFHXXjneUPVEGkowvhOl:uHA/uKq21xWLu758sRo0FHXXlC9IQQ
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2