emotet

General

Target

2025-02-17_c86850ead599555b4bb62450cc7fdbcf_icedid
Size

576KB
Sample

250217-sjcqwazmfm
MD5

c86850ead599555b4bb62450cc7fdbcf
SHA1

ff5422defffe64ba5f52069d987be81452d11af2
SHA256

8f9fddf6ac7e5f99972daa843829842f53fefc32ee5816bc8b78d1488e117f68
SHA512

10039d6842c8b3e8b5353b2939b3d6f8b4ee43cf91451ae75ca4777f25b5baf97671803c86866519dda9df6d1c4a87465ac1e0f005a171dd556d054799ae1124
SSDEEP

6144:XkfswLiSvVz0+oKvX+MjJe3/SgANnrBHmZT6rdm4997veo6OYHFxo:w/OSvl0DKvX+aeONxpXl6OC3

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

185.155.20.82:80

82.223.70.24:8080

58.171.38.26:80

103.86.49.11:8080

31.31.77.83:443

92.222.216.44:8080

186.208.123.210:443

136.243.205.112:7080

60.130.173.117:80

160.16.215.66:8080

98.15.140.226:80

162.241.92.219:8080

78.186.5.109:443

87.127.197.7:8080

168.235.67.138:7080

210.56.10.58:80

60.250.78.22:443

114.145.241.208:80

104.131.11.150:443

62.75.141.82:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-17_c86850ead599555b4bb62450cc7fdbcf_icedid
- Size
  
  576KB
- MD5
  
  c86850ead599555b4bb62450cc7fdbcf
- SHA1
  
  ff5422defffe64ba5f52069d987be81452d11af2
- SHA256
  
  8f9fddf6ac7e5f99972daa843829842f53fefc32ee5816bc8b78d1488e117f68
- SHA512
  
  10039d6842c8b3e8b5353b2939b3d6f8b4ee43cf91451ae75ca4777f25b5baf97671803c86866519dda9df6d1c4a87465ac1e0f005a171dd556d054799ae1124
- SSDEEP
  
  6144:XkfswLiSvVz0+oKvX+MjJe3/SgANnrBHmZT6rdm4997veo6OYHFxo:w/OSvl0DKvX+aeONxpXl6OC3
Score

10^/10

emotet epoch2 banker discovery trojan adware persistence privilege_escalation stealer
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2