emotet

General

Target

e6a1338cdb5cd7a17dd51c7bcda21d9b_JaffaCakes118
Size

617KB
Sample

240917-mmqt1sycqn
MD5

e6a1338cdb5cd7a17dd51c7bcda21d9b
SHA1

397925480a80c1a0bbbd66844652db309c7c0cba
SHA256

0fa3ebc4fec8e550fcca4447923154ac7298b88501dd9debfdc1b5e913aba9fa
SHA512

a1d0343252c7d35a9486eb6e5b4255a2ed47790fb6ece1b2e0dceeb2bb9b857b62c523b0cc117e33ba174f2e92e1e397b615415d58b907f04a552a08192b61d1
SSDEEP

12288:OYzchQVZnkmt/70MWugxPJZFpf0c1pHybdJ8CA88fzsBsI3+Dc:B4KV5Hpt8bZHLW+CSfasO+

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

185.183.16.47:80

190.45.24.210:80

187.162.248.237:80

93.146.143.191:80

185.94.252.27:443

143.0.85.206:7080

80.15.100.37:80

85.105.239.184:443

94.176.234.118:443

62.84.75.50:80

137.74.106.111:7080

172.104.169.32:8080

46.105.114.137:8080

94.126.8.1:80

78.206.229.130:80

93.149.120.214:80

192.175.111.212:7080

rsa_pubkey.plain

Targets

- Target
  
  e6a1338cdb5cd7a17dd51c7bcda21d9b_JaffaCakes118
- Size
  
  617KB
- MD5
  
  e6a1338cdb5cd7a17dd51c7bcda21d9b
- SHA1
  
  397925480a80c1a0bbbd66844652db309c7c0cba
- SHA256
  
  0fa3ebc4fec8e550fcca4447923154ac7298b88501dd9debfdc1b5e913aba9fa
- SHA512
  
  a1d0343252c7d35a9486eb6e5b4255a2ed47790fb6ece1b2e0dceeb2bb9b857b62c523b0cc117e33ba174f2e92e1e397b615415d58b907f04a552a08192b61d1
- SSDEEP
  
  12288:OYzchQVZnkmt/70MWugxPJZFpf0c1pHybdJ8CA88fzsBsI3+Dc:B4KV5Hpt8bZHLW+CSfasO+
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2