emotet

General

Target

JaffaCakes118_7516a7448b7e17df1105d2597f9dd8b10bb0420913bc8007332f6f45f55f285b
Size

361KB
Sample

241229-e9ndeasqb1
MD5

7edae94717ef94c56ef8ce826cf25381
SHA1

a54c0df8d7d5efd7fb4e7ac4e9079e5fa1e85aa0
SHA256

7516a7448b7e17df1105d2597f9dd8b10bb0420913bc8007332f6f45f55f285b
SHA512

0b30e9574ca42498292ad61e5579f139342cc9e6bde5a763be6c7d37a98fc81cc41082cb2870cfcc97853d2a637e49a97e38978174d98af57f286d6b8643f72d
SSDEEP

6144:R+A4ldJyCbC18+LmC3VNbR5jmoUp0AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmhp0LEdMbVXxVi

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

2.45.176.233:80

98.103.204.12:443

172.86.186.21:8080

192.175.111.214:8080

109.190.249.106:80

177.144.130.105:8080

70.32.84.74:8080

192.81.38.31:80

138.97.60.140:8080

189.223.16.99:80

175.143.12.123:8080

190.115.18.139:8080

170.81.48.2:80

5.196.35.138:7080

172.104.169.32:8080

178.250.54.208:8080

185.94.252.27:443

46.105.114.137:8080

79.118.74.90:80

70.169.17.134:80

rsa_pubkey.plain

Targets

- Target
  
  JaffaCakes118_7516a7448b7e17df1105d2597f9dd8b10bb0420913bc8007332f6f45f55f285b
- Size
  
  361KB
- MD5
  
  7edae94717ef94c56ef8ce826cf25381
- SHA1
  
  a54c0df8d7d5efd7fb4e7ac4e9079e5fa1e85aa0
- SHA256
  
  7516a7448b7e17df1105d2597f9dd8b10bb0420913bc8007332f6f45f55f285b
- SHA512
  
  0b30e9574ca42498292ad61e5579f139342cc9e6bde5a763be6c7d37a98fc81cc41082cb2870cfcc97853d2a637e49a97e38978174d98af57f286d6b8643f72d
- SSDEEP
  
  6144:R+A4ldJyCbC18+LmC3VNbR5jmoUp0AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmhp0LEdMbVXxVi
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2