emotet

General

Target

d467c966e5623b6d1692ac070ce5bfa2_JaffaCakes118
Size

240KB
Sample

240908-p44hjsxbnp
MD5

d467c966e5623b6d1692ac070ce5bfa2
SHA1

694bf6ac145d7d2abafcfc8884dd65ab6193cc3e
SHA256

390645fe427a187312045042229f9df314fb7757869f289cedeb5b316dd7f000
SHA512

d0612001dfe2c785ff5af31529464f49be51aae72c2e2f10a845a3a1edbf3a6b42d57022f92ccd31f8f31ef42d5a2c254d6e4cc737f74dd7e24bf55ab61ddb5d
SSDEEP

3072:/k765gyVWFr/7af9eoRhtzjAalu5VGNNBX03jo608hurwTZWf/3:cZmWN/7KQAjkaNXk3joehNW3

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

12.163.208.58:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

192.241.146.84:8080

74.58.215.226:80

199.203.62.165:80

185.94.252.27:443

174.113.69.136:80

46.43.2.95:8080

50.121.220.50:80

192.81.38.31:80

51.38.124.206:80

76.168.54.203:80

51.75.33.127:80

189.2.177.210:443

77.106.157.34:8080

45.33.77.42:8080

178.250.54.208:8080

5.196.35.138:7080

rsa_pubkey.plain

Targets

- Target
  
  d467c966e5623b6d1692ac070ce5bfa2_JaffaCakes118
- Size
  
  240KB
- MD5
  
  d467c966e5623b6d1692ac070ce5bfa2
- SHA1
  
  694bf6ac145d7d2abafcfc8884dd65ab6193cc3e
- SHA256
  
  390645fe427a187312045042229f9df314fb7757869f289cedeb5b316dd7f000
- SHA512
  
  d0612001dfe2c785ff5af31529464f49be51aae72c2e2f10a845a3a1edbf3a6b42d57022f92ccd31f8f31ef42d5a2c254d6e4cc737f74dd7e24bf55ab61ddb5d
- SSDEEP
  
  3072:/k765gyVWFr/7af9eoRhtzjAalu5VGNNBX03jo608hurwTZWf/3:cZmWN/7KQAjkaNXk3joehNW3
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2