emotet

General

Target

2025-02-21_57565feec561d1d382a37dc5782c397b_icedid
Size

184KB
Sample

250221-1rhk4asrt3
MD5

57565feec561d1d382a37dc5782c397b
SHA1

b3247a26b6440e2c65a69dc1381cdda5254e57f1
SHA256

50c3de91b425b97b5dd6d918fd277cd98d471901224bb2f85f03871236c0f20a
SHA512

79eaaa1a44551ec57ce14a7be4e074204d80112661be4ab52bcd9eb9ad695752572d8ff2772a878d33dca29afa89868264af3e68527a9dfc738619447289522d
SSDEEP

3072:zon5PjBJokGrfm0XIyehMiwlqx0+6izlN/eHBPLZ0GDik4KQdSyU1:C5PjBukGrecTAMVq23iT/yBPhDikfy

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

72.143.73.234:443

162.241.140.129:8080

104.131.123.136:443

5.196.108.189:8080

62.75.141.82:80

76.175.162.101:80

130.0.132.242:80

79.137.83.50:443

104.131.44.150:8080

109.74.5.95:8080

121.7.31.214:80

176.111.60.55:8080

172.104.97.173:8080

61.19.246.238:443

47.144.21.12:443

110.142.236.207:80

181.169.235.7:80

123.176.25.234:80

185.94.252.104:443

108.46.29.236:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-21_57565feec561d1d382a37dc5782c397b_icedid
- Size
  
  184KB
- MD5
  
  57565feec561d1d382a37dc5782c397b
- SHA1
  
  b3247a26b6440e2c65a69dc1381cdda5254e57f1
- SHA256
  
  50c3de91b425b97b5dd6d918fd277cd98d471901224bb2f85f03871236c0f20a
- SHA512
  
  79eaaa1a44551ec57ce14a7be4e074204d80112661be4ab52bcd9eb9ad695752572d8ff2772a878d33dca29afa89868264af3e68527a9dfc738619447289522d
- SSDEEP
  
  3072:zon5PjBJokGrfm0XIyehMiwlqx0+6izlN/eHBPLZ0GDik4KQdSyU1:C5PjBukGrecTAMVq23iT/yBPhDikfy
Score

10^/10

emotet epoch2 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2