emotet

General

Target

2025-03-07_1a959249d78a3a300b5719584df79322_icedid_ramnit
Size

384KB
Sample

250307-ecpj7stqx6
MD5

1a959249d78a3a300b5719584df79322
SHA1

fa4f7c973db2f806da22ddaf06787dd627d0c9c3
SHA256

7287aa6994434e9f259a0042ee5b3ebb1b3a31976edf0a4730749c850d533d6f
SHA512

a168dcc5f9dfe68cc250c2dbefee19bd549c4b178a9062f15e657903160b1402dd434ba40805bb8832405fc78da9740b70b856feef89647ce5fcfee54c62daf9
SSDEEP

6144:sJ3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9jifJqCtc9jeGbfUTpYDDmu/+3fbK:sTxaUCh93FxmuIE2YtG+pG/YK

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

64.88.202.250:80

212.51.142.238:8080

200.55.243.138:8080

104.236.246.93:8080

61.19.246.238:443

79.45.112.220:80

95.213.236.64:8080

169.239.182.217:8080

103.86.49.11:8080

87.106.139.101:8080

74.208.45.104:8080

113.160.130.116:8443

209.141.54.221:8080

203.153.216.189:7080

73.11.153.178:8080

186.208.123.210:443

37.187.72.193:8080

201.173.217.124:443

121.124.124.40:7080

24.1.189.87:8080

rsa_pubkey.plain

Targets

- Target
  
  2025-03-07_1a959249d78a3a300b5719584df79322_icedid_ramnit
- Size
  
  384KB
- MD5
  
  1a959249d78a3a300b5719584df79322
- SHA1
  
  fa4f7c973db2f806da22ddaf06787dd627d0c9c3
- SHA256
  
  7287aa6994434e9f259a0042ee5b3ebb1b3a31976edf0a4730749c850d533d6f
- SHA512
  
  a168dcc5f9dfe68cc250c2dbefee19bd549c4b178a9062f15e657903160b1402dd434ba40805bb8832405fc78da9740b70b856feef89647ce5fcfee54c62daf9
- SSDEEP
  
  6144:sJ3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9jifJqCtc9jeGbfUTpYDDmu/+3fbK:sTxaUCh93FxmuIE2YtG+pG/YK
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2