emotet

General

Target

2025-02-27_2b2081c4c5694704e014a68a9669f378_magniber_ramnit
Size

712KB
Sample

250227-hkexhsyxfy
MD5

2b2081c4c5694704e014a68a9669f378
SHA1

0f6afda2222199f9109bc7cc0848b56c6e062f9a
SHA256

21e63aa7fb713f095b210f0c2a77a0a715339a92d36b88b7d6a3f787a9f30a13
SHA512

6a4fc0af14bf852893a32c1bc99480049e3966264501d7bfb0f0e5d9ad3187cfccd4be2454f4bd8bedf1b240027c1ce141a61dd49cea1ef1570446fe32a78175
SSDEEP

12288:feEF5m0kU5o5V6V817yQdgdpOof6yA/Vq/G6xQMbGIRWNpGk7jEvf5m+ZgxG6gpX:jn7xWTkpOjrUXypuOgY0

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80

rsa_pubkey.plain

Targets

- Target
  
  2025-02-27_2b2081c4c5694704e014a68a9669f378_magniber_ramnit
- Size
  
  712KB
- MD5
  
  2b2081c4c5694704e014a68a9669f378
- SHA1
  
  0f6afda2222199f9109bc7cc0848b56c6e062f9a
- SHA256
  
  21e63aa7fb713f095b210f0c2a77a0a715339a92d36b88b7d6a3f787a9f30a13
- SHA512
  
  6a4fc0af14bf852893a32c1bc99480049e3966264501d7bfb0f0e5d9ad3187cfccd4be2454f4bd8bedf1b240027c1ce141a61dd49cea1ef1570446fe32a78175
- SSDEEP
  
  12288:feEF5m0kU5o5V6V817yQdgdpOof6yA/Vq/G6xQMbGIRWNpGk7jEvf5m+ZgxG6gpX:jn7xWTkpOjrUXypuOgY0
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2