emotet

General

Target

2025-02-27_208ed9c20f5b96eb2ca69634d2371aab_icedid_ramnit
Size

424KB
Sample

250227-hh3kssyxcx
MD5

208ed9c20f5b96eb2ca69634d2371aab
SHA1

b57f9a47706ed0932aee4b6035e4d6e2378ba752
SHA256

06241337b04da2b0a2524861b09665f67b0c671c7019a74819cf78c09ef6bbf4
SHA512

01caf350c222fadf16a0211891d021eeb2adf17288f8b643803a5365930f742b7f25f45def208650b8d82f4539554f2b53c21bb98bfa50cc863bfeb5932e72ad
SSDEEP

6144:3uYjzcrl7TTFAk9mWvBwJ+1kyUbasEBzARcqGwdqPyr6s98i9s+TeGbfUTpYDDmL:3uYgTFBgMKQkp4mcqZF2i2+qG+pG/YN

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

185.155.20.82:80

82.223.70.24:8080

58.171.38.26:80

103.86.49.11:8080

31.31.77.83:443

92.222.216.44:8080

186.208.123.210:443

136.243.205.112:7080

60.130.173.117:80

160.16.215.66:8080

98.15.140.226:80

162.241.92.219:8080

78.186.5.109:443

87.127.197.7:8080

168.235.67.138:7080

210.56.10.58:80

60.250.78.22:443

114.145.241.208:80

104.131.11.150:443

62.75.141.82:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-27_208ed9c20f5b96eb2ca69634d2371aab_icedid_ramnit
- Size
  
  424KB
- MD5
  
  208ed9c20f5b96eb2ca69634d2371aab
- SHA1
  
  b57f9a47706ed0932aee4b6035e4d6e2378ba752
- SHA256
  
  06241337b04da2b0a2524861b09665f67b0c671c7019a74819cf78c09ef6bbf4
- SHA512
  
  01caf350c222fadf16a0211891d021eeb2adf17288f8b643803a5365930f742b7f25f45def208650b8d82f4539554f2b53c21bb98bfa50cc863bfeb5932e72ad
- SSDEEP
  
  6144:3uYjzcrl7TTFAk9mWvBwJ+1kyUbasEBzARcqGwdqPyr6s98i9s+TeGbfUTpYDDmL:3uYgTFBgMKQkp4mcqZF2i2+qG+pG/YN
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2