emotet

General

Target

JaffaCakes118_f88d02c7b87bf38fa739f6987eeb18bb01361dfe120d3f7a0a7221453a5c9747
Size

361KB
Sample

241224-nnd3aawmhv
MD5

7c8997f2ba422fd4971e0e84821088a6
SHA1

820ce25d3c430eb83a22f606a363aff25172689d
SHA256

f88d02c7b87bf38fa739f6987eeb18bb01361dfe120d3f7a0a7221453a5c9747
SHA512

44c6c293f869dc15eb73d027be852f80ed91d937a3a2ceb0865b6b61d7cea36101fd0c23a6048703de3196f25bb0869f24a818151a69bb10eb7e16668091d898
SSDEEP

6144:R+A4ldJyCbC18+LmC3VNbR5jmoU60AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmh60LEdMbVXxVi

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

2.45.176.233:80

98.103.204.12:443

172.86.186.21:8080

192.175.111.214:8080

109.190.249.106:80

177.144.130.105:8080

70.32.84.74:8080

192.81.38.31:80

138.97.60.140:8080

189.223.16.99:80

175.143.12.123:8080

190.115.18.139:8080

170.81.48.2:80

5.196.35.138:7080

172.104.169.32:8080

178.250.54.208:8080

185.94.252.27:443

46.105.114.137:8080

79.118.74.90:80

70.169.17.134:80

rsa_pubkey.plain

Targets

- Target
  
  JaffaCakes118_f88d02c7b87bf38fa739f6987eeb18bb01361dfe120d3f7a0a7221453a5c9747
- Size
  
  361KB
- MD5
  
  7c8997f2ba422fd4971e0e84821088a6
- SHA1
  
  820ce25d3c430eb83a22f606a363aff25172689d
- SHA256
  
  f88d02c7b87bf38fa739f6987eeb18bb01361dfe120d3f7a0a7221453a5c9747
- SHA512
  
  44c6c293f869dc15eb73d027be852f80ed91d937a3a2ceb0865b6b61d7cea36101fd0c23a6048703de3196f25bb0869f24a818151a69bb10eb7e16668091d898
- SSDEEP
  
  6144:R+A4ldJyCbC18+LmC3VNbR5jmoU60AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmh60LEdMbVXxVi
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2