emotet

General

Target

JaffaCakes118_dd1a0b4bdac9b5282d6d125d045da3f7b0f9d4dec34ec0c5f10e1012ac4e3cb1
Size

361KB
Sample

241230-21xbaasqfq
MD5

5256433839d1917454eee9f262de5dd5
SHA1

f58220ee4b76b527285a6e3874fa63f6dbc04e1a
SHA256

dd1a0b4bdac9b5282d6d125d045da3f7b0f9d4dec34ec0c5f10e1012ac4e3cb1
SHA512

3a77d2df78d77f8a7ab58362e52de9eeb326d25d18535ab0d1e19ed353920b1af356abee7b72c8aa49577b045fb817b92fc8f8476a108cca5e1de3e292d468ac
SSDEEP

6144:R+A4ldJyCbC18+LmC3VNbR5jmoUm0AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmhm0LEdMbVXxVi

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

2.45.176.233:80

98.103.204.12:443

172.86.186.21:8080

192.175.111.214:8080

109.190.249.106:80

177.144.130.105:8080

70.32.84.74:8080

192.81.38.31:80

138.97.60.140:8080

189.223.16.99:80

175.143.12.123:8080

190.115.18.139:8080

170.81.48.2:80

5.196.35.138:7080

172.104.169.32:8080

178.250.54.208:8080

185.94.252.27:443

46.105.114.137:8080

79.118.74.90:80

70.169.17.134:80

rsa_pubkey.plain

Targets

- Target
  
  JaffaCakes118_dd1a0b4bdac9b5282d6d125d045da3f7b0f9d4dec34ec0c5f10e1012ac4e3cb1
- Size
  
  361KB
- MD5
  
  5256433839d1917454eee9f262de5dd5
- SHA1
  
  f58220ee4b76b527285a6e3874fa63f6dbc04e1a
- SHA256
  
  dd1a0b4bdac9b5282d6d125d045da3f7b0f9d4dec34ec0c5f10e1012ac4e3cb1
- SHA512
  
  3a77d2df78d77f8a7ab58362e52de9eeb326d25d18535ab0d1e19ed353920b1af356abee7b72c8aa49577b045fb817b92fc8f8476a108cca5e1de3e292d468ac
- SSDEEP
  
  6144:R+A4ldJyCbC18+LmC3VNbR5jmoUm0AiG4tEeWntM63oqujq9yxVA/R:wyOC18+V3VNbR5jmhm0LEdMbVXxVi
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2