emotet

General

Target

2025-02-27_e31325905017b1904803fba42993bbfd_icedid_ramnit
Size

384KB
Sample

250227-h8prma1ny4
MD5

e31325905017b1904803fba42993bbfd
SHA1

f0692747e142da8762e0d7ebb8b2440f3cfab980
SHA256

11009dab22a9e856caf446d89ef09a5905d67165f409e4f7f8dca572dada2a6e
SHA512

448e230c67a1f3977c47b53589eab8ae9338fa8f2778767583cf5867e9349b008354073fa96c4a2a31f998ab70919bfc7cf5b9291b0e6b56edcb881e087f1ab0
SSDEEP

6144:so3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9Iy3kNT1keGbfUTpYDDmu/+3fbH:sUxaUCh93FxmuIE2VE19G+pG/YH

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

41.169.20.147:8090

72.10.33.195:8080

177.0.241.28:80

82.165.15.188:8080

190.111.215.4:8080

46.49.124.53:80

190.63.7.166:8080

45.118.136.92:8080

220.128.125.18:80

178.153.214.228:80

139.59.12.63:8080

163.172.107.70:8080

190.251.235.239:80

46.32.229.152:8080

78.188.170.128:80

110.44.113.2:8080

77.74.78.80:443

37.70.131.107:80

188.0.135.237:80

188.251.213.180:443

rsa_pubkey.plain

Targets

- Target
  
  2025-02-27_e31325905017b1904803fba42993bbfd_icedid_ramnit
- Size
  
  384KB
- MD5
  
  e31325905017b1904803fba42993bbfd
- SHA1
  
  f0692747e142da8762e0d7ebb8b2440f3cfab980
- SHA256
  
  11009dab22a9e856caf446d89ef09a5905d67165f409e4f7f8dca572dada2a6e
- SHA512
  
  448e230c67a1f3977c47b53589eab8ae9338fa8f2778767583cf5867e9349b008354073fa96c4a2a31f998ab70919bfc7cf5b9291b0e6b56edcb881e087f1ab0
- SSDEEP
  
  6144:so3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9Iy3kNT1keGbfUTpYDDmu/+3fbH:sUxaUCh93FxmuIE2VE19G+pG/YH
Score

10^/10

emotet ramnit epoch3 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2