emotet

General

Target

ee0ff28225ac3cc3ed314fd17f448877_JaffaCakes118
Size

308KB
Sample

240920-vse9gaxfjc
MD5

ee0ff28225ac3cc3ed314fd17f448877
SHA1

9be8826418704f6605b0e1bfcef797af21171e0a
SHA256

f592488089195001deed3279f9d85cad7ac4bbfde8db9d7688d3f10be7b1c46b
SHA512

2d6c64b6234f4fc0dde07b3d29886f24385301950e27b084064483c1f40ad40a8c6edc149c7aed99ddacc3082a2b96362164ddfed55f8f6da59e11d3adb5ace4
SSDEEP

3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZeH:MPCum81YIPQMCuyDDlB25y4ZeH

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Targets

- Target
  
  ee0ff28225ac3cc3ed314fd17f448877_JaffaCakes118
- Size
  
  308KB
- MD5
  
  ee0ff28225ac3cc3ed314fd17f448877
- SHA1
  
  9be8826418704f6605b0e1bfcef797af21171e0a
- SHA256
  
  f592488089195001deed3279f9d85cad7ac4bbfde8db9d7688d3f10be7b1c46b
- SHA512
  
  2d6c64b6234f4fc0dde07b3d29886f24385301950e27b084064483c1f40ad40a8c6edc149c7aed99ddacc3082a2b96362164ddfed55f8f6da59e11d3adb5ace4
- SSDEEP
  
  3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZeH:MPCum81YIPQMCuyDDlB25y4ZeH
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2