emotet

General

Target

2025-02-27_1754da651c93a95229d9a0d1eb630d2e_icedid_ramnit
Size

983KB
Sample

250227-g8fchszlv7
MD5

1754da651c93a95229d9a0d1eb630d2e
SHA1

327cad13da8d5aee3039a0752ecfdd8b0e71f49e
SHA256

c43c5a8737c374e992fe42d48e47afebc332808ae67c3cb518a6bd423e01de0c
SHA512

c84029e04ebf3a6ae7a9e3aa4276b422f9e5eef46580ab35ed0ad484de9e72ec4b5493237832a01401c45aba8553d729247b49c7d0b19f01e930183183f5b565
SSDEEP

24576:QXpbIepQsZap5bUT5DOUY0xSZyqjTJRP/nsweyBVoxGqv/53rpGO5+MiG8juEgYr:QX+4QsZapWTNOcUyqUEgW

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-27_1754da651c93a95229d9a0d1eb630d2e_icedid_ramnit
- Size
  
  983KB
- MD5
  
  1754da651c93a95229d9a0d1eb630d2e
- SHA1
  
  327cad13da8d5aee3039a0752ecfdd8b0e71f49e
- SHA256
  
  c43c5a8737c374e992fe42d48e47afebc332808ae67c3cb518a6bd423e01de0c
- SHA512
  
  c84029e04ebf3a6ae7a9e3aa4276b422f9e5eef46580ab35ed0ad484de9e72ec4b5493237832a01401c45aba8553d729247b49c7d0b19f01e930183183f5b565
- SSDEEP
  
  24576:QXpbIepQsZap5bUT5DOUY0xSZyqjTJRP/nsweyBVoxGqv/53rpGO5+MiG8juEgYr:QX+4QsZapWTNOcUyqUEgW
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2