emotet

General

Target

20c4e87be2fe1ded162bbc84e5671758917ba08f5efe3f97a432259ecf8d7ec5.exe
Size

275KB
Sample

241219-bwxs5s1rdr
MD5

06bcef81d5bed3494d2e11f755f3a147
SHA1

af3baf78e17e4604a62981351e637af7fc7ccaff
SHA256

20c4e87be2fe1ded162bbc84e5671758917ba08f5efe3f97a432259ecf8d7ec5
SHA512

9263df768cb7c8044331294d83b26cdc5cfabec94fe3c4c511aa1695667189ef9296df82aff88f72a0f26e58c05e13dbe3c7ce0eddfe35541ebcaac5dc7d9aaf
SSDEEP

3072:Mlse+h1pgO08zUngVMUhUk8huW9gCC97TlC16pxIsd/6ClKDtdV7fr2yITqfPeAJ:MlseSg5g3atAlDeCx4RdV7yTqfP1B3fH

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Targets

- Target
  
  20c4e87be2fe1ded162bbc84e5671758917ba08f5efe3f97a432259ecf8d7ec5.exe
- Size
  
  275KB
- MD5
  
  06bcef81d5bed3494d2e11f755f3a147
- SHA1
  
  af3baf78e17e4604a62981351e637af7fc7ccaff
- SHA256
  
  20c4e87be2fe1ded162bbc84e5671758917ba08f5efe3f97a432259ecf8d7ec5
- SHA512
  
  9263df768cb7c8044331294d83b26cdc5cfabec94fe3c4c511aa1695667189ef9296df82aff88f72a0f26e58c05e13dbe3c7ce0eddfe35541ebcaac5dc7d9aaf
- SSDEEP
  
  3072:Mlse+h1pgO08zUngVMUhUk8huW9gCC97TlC16pxIsd/6ClKDtdV7fr2yITqfPeAJ:MlseSg5g3atAlDeCx4RdV7yTqfP1B3fH
Score

10^/10

emotet epoch3 banker discovery trojan upx
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2