emotet

General

Target

2025-02-27_c768900ce0bf034af81e07d82f97238b_magniber_ramnit
Size

712KB
Sample

250227-h3jcnazvey
MD5

c768900ce0bf034af81e07d82f97238b
SHA1

ca61b99c0f0b752d3e18eb7ca12cecf4bb4937b6
SHA256

fb6328ae04d89c4137425fd0643b89e36ff7f2bcac66490cdcd3a232f884dad6
SHA512

686b24d44c8f93e07260f0afdc0f3b70fda4d3d9b827fed130cf75eb3db9f6573a00f873d7c0a06344fa5e008493a4af22c8b089a6031ef2211798d25ff42c8a
SSDEEP

12288:QeEF5m0kU5o5V6V817yQdgdpOof6yA/Vq/G6xQMbGIRWNpGk7jEvf5m+ZgxG6gpa:an7xWTkpOjrUXypuBgYK

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-27_c768900ce0bf034af81e07d82f97238b_magniber_ramnit
- Size
  
  712KB
- MD5
  
  c768900ce0bf034af81e07d82f97238b
- SHA1
  
  ca61b99c0f0b752d3e18eb7ca12cecf4bb4937b6
- SHA256
  
  fb6328ae04d89c4137425fd0643b89e36ff7f2bcac66490cdcd3a232f884dad6
- SHA512
  
  686b24d44c8f93e07260f0afdc0f3b70fda4d3d9b827fed130cf75eb3db9f6573a00f873d7c0a06344fa5e008493a4af22c8b089a6031ef2211798d25ff42c8a
- SSDEEP
  
  12288:QeEF5m0kU5o5V6V817yQdgdpOof6yA/Vq/G6xQMbGIRWNpGk7jEvf5m+ZgxG6gpa:an7xWTkpOjrUXypuBgYK
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2