emotet

General

Target

UltraDropper.exe
Size

60KB
Sample

241108-vy1scswcrf
MD5

b2155129ecaf078020239d57841643a6
SHA1

ac3231da4f91bf288f398d7923d717812e1207ca
SHA256

46e78d76c9c3c0305c6a547525b3ea26f9a20e10fcf534a3886921304a5991b4
SHA512

165557e7f186f3a5b2ed6231cc27f86974bf7d1ee539faf963a092fb6d9012191ad37d4f1ce9de8a69fc1ff37135a0f76898c1d91a8d23b328db49f9e9c4c0c3
SSDEEP

768:syT1o1uw3klvq3fWFRsmP1pNXT4Cabs3l+xdTqOf70QuVORH:syNw5fSDz+s3ls8u70QuVs

Score

10^/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/myupdate.exe

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Targets

- Target
  
  UltraDropper.exe
- Size
  
  60KB
- MD5
  
  b2155129ecaf078020239d57841643a6
- SHA1
  
  ac3231da4f91bf288f398d7923d717812e1207ca
- SHA256
  
  46e78d76c9c3c0305c6a547525b3ea26f9a20e10fcf534a3886921304a5991b4
- SHA512
  
  165557e7f186f3a5b2ed6231cc27f86974bf7d1ee539faf963a092fb6d9012191ad37d4f1ce9de8a69fc1ff37135a0f76898c1d91a8d23b328db49f9e9c4c0c3
- SSDEEP
  
  768:syT1o1uw3klvq3fWFRsmP1pNXT4Cabs3l+xdTqOf70QuVORH:syNw5fSDz+s3ls8u70QuVs
Score

10^/10

emotet eternity privateloader epoch5 banker bootkit discovery evasion loader persistence spyware stealer trojan upx
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Eternity family
  eternity
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1