emotet

General

Target

21e82ab9f8d559cc87e09481b21ff8caefbebd6cd2c2a7edc20f63b22cf1e5f5.exe
Size

361KB
Sample

241125-v53kjayjaz
MD5

1a54d35928bd11b9a33675b60f3cb2f2
SHA1

f3ffb60d60ec46bb729b13350767067acb5af052
SHA256

21e82ab9f8d559cc87e09481b21ff8caefbebd6cd2c2a7edc20f63b22cf1e5f5
SHA512

e5aca9eee212258408b7f9e5cb9e918fb35a4aa03ffb8c7ef92eae86a48614947339657d82942896b9d6a2b9ef8b44bcfa963c09c89ef788fde4afb56914cbe2
SSDEEP

6144:R+A4ldJyCbC18+LmC3VNbR5jmoU30AiG4tEeWntM63oqujq9yxVA/R/:wyOC18+V3VNbR5jmh30LEdMbVXxVi/

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

2.45.176.233:80

98.103.204.12:443

172.86.186.21:8080

192.175.111.214:8080

109.190.249.106:80

177.144.130.105:8080

70.32.84.74:8080

192.81.38.31:80

138.97.60.140:8080

189.223.16.99:80

175.143.12.123:8080

190.115.18.139:8080

170.81.48.2:80

5.196.35.138:7080

172.104.169.32:8080

178.250.54.208:8080

185.94.252.27:443

46.105.114.137:8080

79.118.74.90:80

70.169.17.134:80

rsa_pubkey.plain

Targets

- Target
  
  21e82ab9f8d559cc87e09481b21ff8caefbebd6cd2c2a7edc20f63b22cf1e5f5.exe
- Size
  
  361KB
- MD5
  
  1a54d35928bd11b9a33675b60f3cb2f2
- SHA1
  
  f3ffb60d60ec46bb729b13350767067acb5af052
- SHA256
  
  21e82ab9f8d559cc87e09481b21ff8caefbebd6cd2c2a7edc20f63b22cf1e5f5
- SHA512
  
  e5aca9eee212258408b7f9e5cb9e918fb35a4aa03ffb8c7ef92eae86a48614947339657d82942896b9d6a2b9ef8b44bcfa963c09c89ef788fde4afb56914cbe2
- SSDEEP
  
  6144:R+A4ldJyCbC18+LmC3VNbR5jmoU30AiG4tEeWntM63oqujq9yxVA/R/:wyOC18+V3VNbR5jmh30LEdMbVXxVi/
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2