emotet

General

Target

d62eb04979087438511e95a404aeb0ea_JaffaCakes118
Size

346KB
Sample

240909-m5q8haxake
MD5

d62eb04979087438511e95a404aeb0ea
SHA1

092fecdcbfc10d1d6bb6bfeb5fa67e69e0523a5b
SHA256

f722d924c8b4ac74cd2e56891f7ac42ddddf2735a69414aafae7fcfe3399f4a6
SHA512

7a00ee16c518cd1f16907155a53456f279a46f04f94e301c7a58ce81ce520f3c34642318d5a61b3eb0b6db3c71103e82b10f68f8468fed3e71cc1bf805510cd1
SSDEEP

3072:582jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:a2L7HN7Kl/jLA90QECrYRpj

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

51.15.7.145:80

177.85.167.10:80

186.177.174.163:80

190.114.254.163:8080

185.183.16.47:80

149.202.72.142:7080

181.30.61.163:443

31.27.59.105:80

50.28.51.143:8080

68.183.190.199:8080

85.214.26.7:8080

137.74.106.111:7080

200.75.39.254:80

85.105.239.184:443

190.45.24.210:80

170.81.48.2:80

109.101.137.162:8080

rsa_pubkey.plain

Targets

- Target
  
  d62eb04979087438511e95a404aeb0ea_JaffaCakes118
- Size
  
  346KB
- MD5
  
  d62eb04979087438511e95a404aeb0ea
- SHA1
  
  092fecdcbfc10d1d6bb6bfeb5fa67e69e0523a5b
- SHA256
  
  f722d924c8b4ac74cd2e56891f7ac42ddddf2735a69414aafae7fcfe3399f4a6
- SHA512
  
  7a00ee16c518cd1f16907155a53456f279a46f04f94e301c7a58ce81ce520f3c34642318d5a61b3eb0b6db3c71103e82b10f68f8468fed3e71cc1bf805510cd1
- SSDEEP
  
  3072:582jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:a2L7HN7Kl/jLA90QECrYRpj
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2