emotet

General

Target

ff7156dcfa66a4e7094bc5c199a9da43_JaffaCakes118
Size

212KB
Sample

240929-2wa79avakr
MD5

ff7156dcfa66a4e7094bc5c199a9da43
SHA1

ceb7c14b5638f2b6143b0fa6e9a9cc427ed7aa1f
SHA256

0337c585532a4a3cbed48602fe42563e965b8d853432391633e1da888f1946e3
SHA512

38fd76a3dac84315b92b11b94f6262cf18be78f046de77ce7228e1f3ef8c9f2162662cc6981434954d3f68176a7f67e54f4904b72800ce130d65d0aeed498a41
SSDEEP

3072:0izbxqLRv2ZCgg1y1t3QoqVePUQGTbgYd/XsLlCP2wj:0Oq55h10JQpeJGT8Yd/X8lS2u

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.144.236.211:443

95.219.199.225:80

125.230.36.147:443

104.236.137.72:8080

172.104.233.225:8080

213.189.36.51:8080

85.234.143.94:8080

2.38.99.79:80

200.113.106.18:80

181.135.153.203:443

201.163.74.202:443

185.86.148.222:8080

189.173.113.67:443

68.183.170.114:8080

187.190.49.92:443

181.231.62.54:80

134.209.214.126:8080

87.118.70.69:8080

47.187.70.124:443

82.196.15.205:8080

rsa_pubkey.plain

Targets

- Target
  
  ff7156dcfa66a4e7094bc5c199a9da43_JaffaCakes118
- Size
  
  212KB
- MD5
  
  ff7156dcfa66a4e7094bc5c199a9da43
- SHA1
  
  ceb7c14b5638f2b6143b0fa6e9a9cc427ed7aa1f
- SHA256
  
  0337c585532a4a3cbed48602fe42563e965b8d853432391633e1da888f1946e3
- SHA512
  
  38fd76a3dac84315b92b11b94f6262cf18be78f046de77ce7228e1f3ef8c9f2162662cc6981434954d3f68176a7f67e54f4904b72800ce130d65d0aeed498a41
- SSDEEP
  
  3072:0izbxqLRv2ZCgg1y1t3QoqVePUQGTbgYd/XsLlCP2wj:0Oq55h10JQpeJGT8Yd/X8lS2u
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2