emotet

General

Target

68f2bea926ddb08eaa869552fada06d03ad5446f2f9708b8d1db94923e9e90c5
Size

312KB
Sample

241120-3kmbtawkbt
MD5

f576b80cf201b8123726de2e618d8138
SHA1

e5f64475057f3cb07ed5593f51829838428397b8
SHA256

68f2bea926ddb08eaa869552fada06d03ad5446f2f9708b8d1db94923e9e90c5
SHA512

840695440b7f464bc0a0b6748d6158f1ce9258b0be5ab118e4afe100e71d851aa25545f41f64c1d4cfc33f8f883a9d4507fef88a848d58e6d5769567885284e1
SSDEEP

3072:4p3aW/1n8xO32P1TdtJgqHXvAusfQatOCgMxfkP7vtRJ5tiGGakrNeH7tdjI9bYc:4YI8k32P1ptJgOAdCufYx5tZceHRdj2

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

186.109.104.67:80

185.86.148.68:443

139.99.157.213:8080

203.153.216.178:7080

192.163.221.191:8080

201.235.10.215:80

37.46.129.215:8080

78.189.60.109:443

77.74.78.80:443

143.95.101.72:8080

188.251.213.180:443

31.146.61.34:80

190.53.144.120:80

105.209.235.113:8080

115.78.11.155:80

172.96.190.154:8080

50.116.78.109:8080

188.0.135.237:80

179.62.238.49:80

197.83.232.19:80

rsa_pubkey.plain

Targets

- Target
  
  68f2bea926ddb08eaa869552fada06d03ad5446f2f9708b8d1db94923e9e90c5
- Size
  
  312KB
- MD5
  
  f576b80cf201b8123726de2e618d8138
- SHA1
  
  e5f64475057f3cb07ed5593f51829838428397b8
- SHA256
  
  68f2bea926ddb08eaa869552fada06d03ad5446f2f9708b8d1db94923e9e90c5
- SHA512
  
  840695440b7f464bc0a0b6748d6158f1ce9258b0be5ab118e4afe100e71d851aa25545f41f64c1d4cfc33f8f883a9d4507fef88a848d58e6d5769567885284e1
- SSDEEP
  
  3072:4p3aW/1n8xO32P1TdtJgqHXvAusfQatOCgMxfkP7vtRJ5tiGGakrNeH7tdjI9bYc:4YI8k32P1ptJgOAdCufYx5tZceHRdj2
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2