emotet

General

Target

45434924c4c1c19e62c5c259a58ca7ce0ebd61f023cc25b1a59466e0efad827cN.exe
Size

361KB
Sample

241126-mx5e6atrfp
MD5

522f824c191cea32295b3ed5ec58b950
SHA1

15ee4bc19f25c1e2d48e822de7048f6d9952e196
SHA256

45434924c4c1c19e62c5c259a58ca7ce0ebd61f023cc25b1a59466e0efad827c
SHA512

3be1609f4d13a27092633ec4ad1a6ea15e2da14b5b460cb2bfc17a8810c6bd87a6ebddd502f1ae726cfbd854a9cc56fb74bcc2cacf91abd02bf0be94979a66ff
SSDEEP

6144:R+A4ldJyCbC18+LmC3VNbR5jmoU30AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmh30LEdMbVXxVi

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

2.45.176.233:80

98.103.204.12:443

172.86.186.21:8080

192.175.111.214:8080

109.190.249.106:80

177.144.130.105:8080

70.32.84.74:8080

192.81.38.31:80

138.97.60.140:8080

189.223.16.99:80

175.143.12.123:8080

190.115.18.139:8080

170.81.48.2:80

5.196.35.138:7080

172.104.169.32:8080

178.250.54.208:8080

185.94.252.27:443

46.105.114.137:8080

79.118.74.90:80

70.169.17.134:80

rsa_pubkey.plain

Targets

- Target
  
  45434924c4c1c19e62c5c259a58ca7ce0ebd61f023cc25b1a59466e0efad827cN.exe
- Size
  
  361KB
- MD5
  
  522f824c191cea32295b3ed5ec58b950
- SHA1
  
  15ee4bc19f25c1e2d48e822de7048f6d9952e196
- SHA256
  
  45434924c4c1c19e62c5c259a58ca7ce0ebd61f023cc25b1a59466e0efad827c
- SHA512
  
  3be1609f4d13a27092633ec4ad1a6ea15e2da14b5b460cb2bfc17a8810c6bd87a6ebddd502f1ae726cfbd854a9cc56fb74bcc2cacf91abd02bf0be94979a66ff
- SSDEEP
  
  6144:R+A4ldJyCbC18+LmC3VNbR5jmoU30AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmh30LEdMbVXxVi
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2