emotet

General

Target

JaffaCakes118_b558dffe2e4f1526dab18078c00445e127e3cc6b667748f28da6680513141a66
Size

780KB
Sample

241230-3t8w6sxncz
MD5

654e99a8b1e509d908fd2e20b97a3735
SHA1

f22dce568a89412b2efc014cc052a694999d7938
SHA256

b558dffe2e4f1526dab18078c00445e127e3cc6b667748f28da6680513141a66
SHA512

8a2e804164133b999eb200a8d29c0190518c2156e2c1acf0a4f6c2d02183c608b7ab5a09c628a4c7dde0537c8616f7ecfb8a4bd03f1eecac52d5e03d089c04f4
SSDEEP

12288:5s/YpAp2/yQ0P7BLyP70nKTkgwzDwtAs0owb8ZPnJ0l7FgDZ4liMFdajByR:5GPp2/yQ0PtC0p/w50Pb8wgDZTGMjB

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.80.148.200:443

80.211.3.13:8080

110.232.117.186:8080

45.142.114.231:8080

131.100.24.231:80

107.182.225.142:8080

45.118.135.203:7080

164.68.99.3:8080

212.237.56.116:7080

41.76.108.46:8080

58.227.42.236:80

104.168.155.129:8080

79.172.212.216:8080

192.254.71.210:443

51.38.71.0:443

217.182.143.207:443

203.114.109.124:443

185.157.82.211:8080

173.212.193.249:8080

45.176.232.124:443

eck1.plain

1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw
3
TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg==
4
-----END PUBLIC KEY-----

ecs1.plain

1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov
3
pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==
4
-----END PUBLIC KEY-----

Targets

- Target
  
  JaffaCakes118_b558dffe2e4f1526dab18078c00445e127e3cc6b667748f28da6680513141a66
- Size
  
  780KB
- MD5
  
  654e99a8b1e509d908fd2e20b97a3735
- SHA1
  
  f22dce568a89412b2efc014cc052a694999d7938
- SHA256
  
  b558dffe2e4f1526dab18078c00445e127e3cc6b667748f28da6680513141a66
- SHA512
  
  8a2e804164133b999eb200a8d29c0190518c2156e2c1acf0a4f6c2d02183c608b7ab5a09c628a4c7dde0537c8616f7ecfb8a4bd03f1eecac52d5e03d089c04f4
- SSDEEP
  
  12288:5s/YpAp2/yQ0P7BLyP70nKTkgwzDwtAs0owb8ZPnJ0l7FgDZ4liMFdajByR:5GPp2/yQ0PtC0p/w50Pb8wgDZTGMjB
Score

10^/10

emotet epoch4 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.