emotet

General

Target

dbf74da7a82a86e8870fc30fbc759f41_JaffaCakes118
Size

330KB
Sample

240912-g127bavfrj
MD5

dbf74da7a82a86e8870fc30fbc759f41
SHA1

11245052982697b3b4e88cce9b63ef6eb702163d
SHA256

53949e5861b1a9d9bf14dcf94ea2ecb6be88704b879ab9f2dcb1bc32f48cd606
SHA512

df1ae4cfffcf17f9233367caafdd41a6d8106b18aad6ba6a97cfb763a154d50d627cc7e81f565bb48f540584e06a1c7a9bec7a7b5419a013a86db9c41db1f224
SSDEEP

3072:gRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:qq1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

109.99.146.210:8080

116.202.10.123:8080

172.96.190.154:8080

163.53.204.180:443

190.107.118.125:80

91.93.3.85:8080

185.142.236.163:443

115.79.195.246:80

120.51.34.254:80

192.210.217.94:8080

198.20.228.9:8080

91.75.75.46:80

54.38.143.245:8080

161.49.84.2:80

162.144.145.58:8080

178.33.167.120:8080

201.193.160.196:80

rsa_pubkey.plain

Targets

- Target
  
  dbf74da7a82a86e8870fc30fbc759f41_JaffaCakes118
- Size
  
  330KB
- MD5
  
  dbf74da7a82a86e8870fc30fbc759f41
- SHA1
  
  11245052982697b3b4e88cce9b63ef6eb702163d
- SHA256
  
  53949e5861b1a9d9bf14dcf94ea2ecb6be88704b879ab9f2dcb1bc32f48cd606
- SHA512
  
  df1ae4cfffcf17f9233367caafdd41a6d8106b18aad6ba6a97cfb763a154d50d627cc7e81f565bb48f540584e06a1c7a9bec7a7b5419a013a86db9c41db1f224
- SSDEEP
  
  3072:gRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:qq1sFAwgwmBv3wnIgG4oAYxvU54eu
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2