emotet

General

Target

da49abdbad1bdaf594a029b600a2d9d5_JaffaCakes118
Size

340KB
Sample

240911-nz6lnsyhme
MD5

da49abdbad1bdaf594a029b600a2d9d5
SHA1

0628bc15100fd6c24d5731a1bb0a8533d16af7c3
SHA256

18905d235738c85e882acbd78832016ed84a4ad6166fc69f4f21541e9ea1e371
SHA512

f698909cc41ed9a21c1c7c1a999569f112efcc82c615d790278a6bdca73a6d9abe088c8f600389fb96e3f357defeee89556e841d9bacd71f9988193c8a385127
SSDEEP

3072:DvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:D206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----

Targets

- Target
  
  da49abdbad1bdaf594a029b600a2d9d5_JaffaCakes118
- Size
  
  340KB
- MD5
  
  da49abdbad1bdaf594a029b600a2d9d5
- SHA1
  
  0628bc15100fd6c24d5731a1bb0a8533d16af7c3
- SHA256
  
  18905d235738c85e882acbd78832016ed84a4ad6166fc69f4f21541e9ea1e371
- SHA512
  
  f698909cc41ed9a21c1c7c1a999569f112efcc82c615d790278a6bdca73a6d9abe088c8f600389fb96e3f357defeee89556e841d9bacd71f9988193c8a385127
- SSDEEP
  
  3072:DvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:D206xWgGxLxWN40PDKR/JnX2P
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.