emotet

General

Target

d47313c13f3cecc8963c1ad3d29c112768ead5c2622f0d97dd7fc40be72276f9N.exe
Size

154KB
Sample

241219-f48mts1nap
MD5

dee1c6afa33364f1244e862316f175d0
SHA1

c9b6b1b89d26c74809816f6800f4adbc814b8a70
SHA256

d47313c13f3cecc8963c1ad3d29c112768ead5c2622f0d97dd7fc40be72276f9
SHA512

5260f6b1a1e842c78b5d7949f02883486ade94b799d0315800c39517224eb4b918f0b1931d9b15e28467f24ba87b9fdf35abecfa9380c25dc8c4925a7e44bbfb
SSDEEP

3072:uxwGkliAs4eOWdCYhG2rV5yhNFIWps3d78Mw+dXM47ulimTt8G5s6a:YulPynhRrV5ceof4CN84

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20

rsa_pubkey.plain

Targets

- Target
  
  d47313c13f3cecc8963c1ad3d29c112768ead5c2622f0d97dd7fc40be72276f9N.exe
- Size
  
  154KB
- MD5
  
  dee1c6afa33364f1244e862316f175d0
- SHA1
  
  c9b6b1b89d26c74809816f6800f4adbc814b8a70
- SHA256
  
  d47313c13f3cecc8963c1ad3d29c112768ead5c2622f0d97dd7fc40be72276f9
- SHA512
  
  5260f6b1a1e842c78b5d7949f02883486ade94b799d0315800c39517224eb4b918f0b1931d9b15e28467f24ba87b9fdf35abecfa9380c25dc8c4925a7e44bbfb
- SSDEEP
  
  3072:uxwGkliAs4eOWdCYhG2rV5yhNFIWps3d78Mw+dXM47ulimTt8G5s6a:YulPynhRrV5ceof4CN84
Score

10^/10

emotet epoch2 banker discovery trojan upx
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2