emotet

General

Target

e128753f6b4f2def302e4470b9de80bba06b93a064539adfdcbfa5ee9528760b
Size

125KB
Sample

241120-3yetwsxalp
MD5

65dfda2fb565332bb3a7da7d44142057
SHA1

727a3c553798255f8eb5a760724e1bc1a4608b81
SHA256

e128753f6b4f2def302e4470b9de80bba06b93a064539adfdcbfa5ee9528760b
SHA512

3cc4523a5d4f62ae0836ea48a59ce2b4d2e6c74f6fa2e3520fc733647b450f5a5dc1d3bc4a1353677063dd234338fa7a3a337a17edd60fe4ee021838d3b2dcfb
SSDEEP

1536:9r6esjV7B6T78OZ1e1Ix6/8YO+bKz6wueLsrJQLnzBhl/Y6KtBrMmNXeatJ0cpEc:9SOZ1e11G/zxLzBHsXzr0VGiu

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

132.248.38.158:80

203.157.152.9:7080

157.245.145.87:443

110.37.224.243:80

70.32.89.105:8080

185.142.236.163:443

192.241.220.183:8080

91.83.93.103:443

54.38.143.245:8080

192.210.217.94:8080

37.205.9.252:7080

78.90.78.210:80

182.73.7.59:8080

163.53.204.180:443

91.75.75.46:80

172.104.46.84:8080

161.49.84.2:80

27.78.27.110:443

203.160.167.243:80

109.99.146.210:8080

rsa_pubkey.plain

Targets

- Target
  
  phmepmhuwvcronv.nki
- Size
  
  332KB
- MD5
  
  3e1249e4d0b0b61d493da93139b9f3a4
- SHA1
  
  82863b73820e293793dc90da9635c390fc928ef7
- SHA256
  
  03ff40768f2c5dfb8c60c977b173ab72abc0932ccd13d139115bf7f0ddcdb323
- SHA512
  
  4cd7757a187ff99034347bd125e98170832e193ad13f63754f3ee1a159f0d72c59abcd2f9755869ce533c765b9664603c6c38961c49149ea042e7e6894a9aef6
- SSDEEP
  
  3072:Mfv8SZbCiGFeDN7X1qfJvQ+OMv3PmMWZqQi237fpKuiMYuFb:aLuimeDN7X8fJvNRfPmaQb7cuiUb
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2