emotet

General

Target

JaffaCakes118_a5fe0861d5a43acd583d53bd0a5258ae9079c46750abde3fa8b54ef895411581
Size

296KB
Sample

241229-phz81a1nhz
MD5

5dbd726d823a2f45fb643ab63bd1e984
SHA1

5132b793940eaaa64ff90f5a5b3e8c9f36b8f72c
SHA256

a5fe0861d5a43acd583d53bd0a5258ae9079c46750abde3fa8b54ef895411581
SHA512

83e54a1e95015dbae5c1d25c939393f204dda7bbed0e846e2b3f0e036f00bdf09376892667c012a58b03323b45634dd99ec39c7fa2a269b12b83cb82addf6a98
SSDEEP

6144:/BvNm3SpFyFCMCgjMtXGVT3gnkPCGIQ7md8ek/XuY37JUIsEJ:/BvNm3SpFLMC7tMTck6GF7mdvIe+77

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

71.50.31.38:80

185.94.252.13:443

217.199.160.224:7080

181.167.96.215:80

111.67.12.221:8080

68.183.170.114:8080

212.71.237.140:8080

83.169.21.32:7080

190.6.193.152:8080

217.13.106.14:8080

181.31.211.181:80

177.66.190.130:80

192.241.146.84:8080

80.249.176.206:80

204.225.249.100:7080

137.74.106.111:7080

5.196.35.138:7080

104.131.103.37:8080

189.218.165.63:80

170.81.48.2:80

rsa_pubkey.plain

Targets

- Target
  
  JaffaCakes118_a5fe0861d5a43acd583d53bd0a5258ae9079c46750abde3fa8b54ef895411581
- Size
  
  296KB
- MD5
  
  5dbd726d823a2f45fb643ab63bd1e984
- SHA1
  
  5132b793940eaaa64ff90f5a5b3e8c9f36b8f72c
- SHA256
  
  a5fe0861d5a43acd583d53bd0a5258ae9079c46750abde3fa8b54ef895411581
- SHA512
  
  83e54a1e95015dbae5c1d25c939393f204dda7bbed0e846e2b3f0e036f00bdf09376892667c012a58b03323b45634dd99ec39c7fa2a269b12b83cb82addf6a98
- SSDEEP
  
  6144:/BvNm3SpFyFCMCgjMtXGVT3gnkPCGIQ7md8ek/XuY37JUIsEJ:/BvNm3SpFLMC7tMTck6GF7mdvIe+77
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2