emotet

General

Target

d4272e48c9daab41b4e2e8ed586e6ec3_JaffaCakes118
Size

216KB
Sample

240908-mjtfqstcmh
MD5

d4272e48c9daab41b4e2e8ed586e6ec3
SHA1

a002883c8f1f271efe53c48996d4d5e027707674
SHA256

77939cf522b0d7e91f076855eb67e4bb6aeca1dc8b486341fbeddba7013f58f0
SHA512

dd94679ee6380a262ddd326fa23d84393c5174f633aa818fc23799842db32e15f0b8227fdb035bf6e5a176fc55a6e8b44189f69e3d0a461a7ee5a1b15d168d53
SSDEEP

3072:cg7bQUu+UClJMP8R+t/LeZYN5555MxVdZ8g3HnIX8MyM:HbfumK7LeZo55cvdZxsyM

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

70.116.143.84:80

51.75.33.127:80

37.157.196.117:7080

116.202.23.3:8080

187.162.248.237:80

204.225.249.100:7080

67.247.242.247:80

192.241.146.84:8080

178.250.54.208:8080

188.135.15.49:80

77.238.212.227:80

152.169.22.67:80

186.103.141.250:443

82.76.111.249:443

213.197.182.158:8080

201.213.177.139:80

74.136.144.133:80

72.47.248.48:7080

51.38.124.206:80

190.24.243.186:80

rsa_pubkey.plain

Targets

- Target
  
  d4272e48c9daab41b4e2e8ed586e6ec3_JaffaCakes118
- Size
  
  216KB
- MD5
  
  d4272e48c9daab41b4e2e8ed586e6ec3
- SHA1
  
  a002883c8f1f271efe53c48996d4d5e027707674
- SHA256
  
  77939cf522b0d7e91f076855eb67e4bb6aeca1dc8b486341fbeddba7013f58f0
- SHA512
  
  dd94679ee6380a262ddd326fa23d84393c5174f633aa818fc23799842db32e15f0b8227fdb035bf6e5a176fc55a6e8b44189f69e3d0a461a7ee5a1b15d168d53
- SSDEEP
  
  3072:cg7bQUu+UClJMP8R+t/LeZYN5555MxVdZ8g3HnIX8MyM:HbfumK7LeZo55cvdZxsyM
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2