emotet

General

Target

e129a71257eb51c6e8f7745a0ac1580e_JaffaCakes118
Size

330KB
Sample

240914-2dlk9szfqn
MD5

e129a71257eb51c6e8f7745a0ac1580e
SHA1

c9c3668b577862d1584dda61b50f1d046e066c4c
SHA256

d6c3dd35cec0defd114f7b1f7268c5660e0ecde549d85bc0ad32292c8e9f4992
SHA512

ea2b1ecbd94996b05ccba6a3dc2610515f264c6d95f0294ccbcb4925e11ce844225649039121fdb0c3fc1496e669140cec2158b606155485c7bd171dad38505a
SSDEEP

3072:vRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:5q1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

109.99.146.210:8080

116.202.10.123:8080

172.96.190.154:8080

163.53.204.180:443

190.107.118.125:80

91.93.3.85:8080

185.142.236.163:443

115.79.195.246:80

120.51.34.254:80

192.210.217.94:8080

198.20.228.9:8080

91.75.75.46:80

54.38.143.245:8080

161.49.84.2:80

162.144.145.58:8080

178.33.167.120:8080

201.193.160.196:80

rsa_pubkey.plain

Targets

- Target
  
  e129a71257eb51c6e8f7745a0ac1580e_JaffaCakes118
- Size
  
  330KB
- MD5
  
  e129a71257eb51c6e8f7745a0ac1580e
- SHA1
  
  c9c3668b577862d1584dda61b50f1d046e066c4c
- SHA256
  
  d6c3dd35cec0defd114f7b1f7268c5660e0ecde549d85bc0ad32292c8e9f4992
- SHA512
  
  ea2b1ecbd94996b05ccba6a3dc2610515f264c6d95f0294ccbcb4925e11ce844225649039121fdb0c3fc1496e669140cec2158b606155485c7bd171dad38505a
- SSDEEP
  
  3072:vRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:5q1sFAwgwmBv3wnIgG4oAYxvU54eu
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2