emotet

General

Target

d6989d4d113e3e68e63698f929e567d1_JaffaCakes118
Size

425KB
Sample

240909-svmp8avfql
MD5

d6989d4d113e3e68e63698f929e567d1
SHA1

b19292137d446fa05cd4445af1adc7c06fadfc75
SHA256

2ed2376225d35dda2074bf2358221a30530f3fc15b94d0ce0ab206352e48124f
SHA512

4b323e62f552b39bf67cfefe60f4794fe7384d02c202bad4d0d670eb1b7e9d82bfd403955b07257a3a0567fcb5e2df4d8695c24fef5f28b2788764fd3b7a5788
SSDEEP

6144:U+1SOT3qLavbVUGXjDsDaKaIwLnhc/WGLeGFL7b11UOOKmgyyyyyyyyyyyyyyyyz:jCGXqzacuGfFXUOjmIDi+9R9

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

167.99.105.223:7080

176.31.200.130:8080

212.129.24.79:8080

37.187.2.199:443

198.199.114.69:8080

91.205.215.66:8080

190.145.67.134:8090

104.131.11.150:8080

67.225.229.55:8080

167.71.10.37:8080

138.201.140.110:8080

185.187.198.15:80

87.230.19.21:8080

185.94.252.13:443

190.53.135.159:21

87.106.139.101:8080

173.249.47.77:8080

169.239.182.217:8080

133.167.80.63:7080

92.222.216.44:8080

rsa_pubkey.plain

Targets

- Target
  
  d6989d4d113e3e68e63698f929e567d1_JaffaCakes118
- Size
  
  425KB
- MD5
  
  d6989d4d113e3e68e63698f929e567d1
- SHA1
  
  b19292137d446fa05cd4445af1adc7c06fadfc75
- SHA256
  
  2ed2376225d35dda2074bf2358221a30530f3fc15b94d0ce0ab206352e48124f
- SHA512
  
  4b323e62f552b39bf67cfefe60f4794fe7384d02c202bad4d0d670eb1b7e9d82bfd403955b07257a3a0567fcb5e2df4d8695c24fef5f28b2788764fd3b7a5788
- SSDEEP
  
  6144:U+1SOT3qLavbVUGXjDsDaKaIwLnhc/WGLeGFL7b11UOOKmgyyyyyyyyyyyyyyyyz:jCGXqzacuGfFXUOjmIDi+9R9
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2