emotet

General

Target

dce69f3666a2aa632e6d52bb2f485a7a_JaffaCakes118
Size

346KB
Sample

240912-x5a7dszfkl
MD5

dce69f3666a2aa632e6d52bb2f485a7a
SHA1

7dbe38b1c7f5af47dbebcfcc381981e3b55af0f0
SHA256

40f1ed14aa9825456e81c77d51907e8dadfa182ecc8bfedc4295f04921f6cfed
SHA512

738b13e4561b3c10f86e679293b91faf46b83d240108d73b37e41aaf1ab55338b087c4c5f3958f2fb560e44fa9e8f33a796bef263e595d89d98a1f1a970910ce
SSDEEP

3072:/82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:U2L7HN7Kl/jLA90QECrYRpj

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

51.15.7.145:80

177.85.167.10:80

186.177.174.163:80

190.114.254.163:8080

185.183.16.47:80

149.202.72.142:7080

181.30.61.163:443

31.27.59.105:80

50.28.51.143:8080

68.183.190.199:8080

85.214.26.7:8080

137.74.106.111:7080

200.75.39.254:80

85.105.239.184:443

190.45.24.210:80

170.81.48.2:80

109.101.137.162:8080

rsa_pubkey.plain

Targets

- Target
  
  dce69f3666a2aa632e6d52bb2f485a7a_JaffaCakes118
- Size
  
  346KB
- MD5
  
  dce69f3666a2aa632e6d52bb2f485a7a
- SHA1
  
  7dbe38b1c7f5af47dbebcfcc381981e3b55af0f0
- SHA256
  
  40f1ed14aa9825456e81c77d51907e8dadfa182ecc8bfedc4295f04921f6cfed
- SHA512
  
  738b13e4561b3c10f86e679293b91faf46b83d240108d73b37e41aaf1ab55338b087c4c5f3958f2fb560e44fa9e8f33a796bef263e595d89d98a1f1a970910ce
- SSDEEP
  
  3072:/82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:U2L7HN7Kl/jLA90QECrYRpj
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2