emotet

General

Target

af06b10c86ecaf3a56649aaffa58cf37bc6a3dd6ea78a1fb1b550cf120d109a5
Size

424KB
Sample

250228-bwlqwawvc1
MD5

351505f8c93a1851e0de3a85ea7312de
SHA1

546f12f6eeb1b7d57be75db3383a7055c1ed298e
SHA256

af06b10c86ecaf3a56649aaffa58cf37bc6a3dd6ea78a1fb1b550cf120d109a5
SHA512

07e6118d93c25314daeb7242bb3e762bd640c80c4f3366e2bce8b0f8cff80b6f1b148ced685aeebd6fdb33f0fbffdd0b2104207cab669f6240885c53a9250065
SSDEEP

6144:+pkxaStbvBFscy65+Wf7AP5H08e7pV1oRUOeGbfUTpYDDmu/+3fb3:/jtbvM/hi7A6H1oRAG+pG/Y3

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

64.88.202.250:80

212.51.142.238:8080

200.55.243.138:8080

104.236.246.93:8080

61.19.246.238:443

79.45.112.220:80

95.213.236.64:8080

169.239.182.217:8080

103.86.49.11:8080

87.106.139.101:8080

74.208.45.104:8080

113.160.130.116:8443

209.141.54.221:8080

203.153.216.189:7080

73.11.153.178:8080

186.208.123.210:443

37.187.72.193:8080

201.173.217.124:443

121.124.124.40:7080

24.1.189.87:8080

rsa_pubkey.plain

Targets

- Target
  
  af06b10c86ecaf3a56649aaffa58cf37bc6a3dd6ea78a1fb1b550cf120d109a5
- Size
  
  424KB
- MD5
  
  351505f8c93a1851e0de3a85ea7312de
- SHA1
  
  546f12f6eeb1b7d57be75db3383a7055c1ed298e
- SHA256
  
  af06b10c86ecaf3a56649aaffa58cf37bc6a3dd6ea78a1fb1b550cf120d109a5
- SHA512
  
  07e6118d93c25314daeb7242bb3e762bd640c80c4f3366e2bce8b0f8cff80b6f1b148ced685aeebd6fdb33f0fbffdd0b2104207cab669f6240885c53a9250065
- SSDEEP
  
  6144:+pkxaStbvBFscy65+Wf7AP5H08e7pV1oRUOeGbfUTpYDDmu/+3fb3:/jtbvM/hi7A6H1oRAG+pG/Y3
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2