emotet

General

Target

2025-03-07_429e0065875465913b84e3f2ce5e87a4_icedid_ramnit
Size

384KB
Sample

250307-eeb2wstsd1
MD5

429e0065875465913b84e3f2ce5e87a4
SHA1

85a9b74a654d1dd0e7eb2eb690d17f36d8213bf2
SHA256

30841c3bddb578e1bef746343116fdbe85dfecd6064055cc927dc01374057ce5
SHA512

5d4d7edf4cb353e3d70a45a5f18891f91af6f97de025ccd744804f970eaaf39190c5901626d0887f64e126817f2a57928c703fb6ee8923bab87d88e90cd0495c
SSDEEP

6144:sU3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9YifJqCtc9HeGbfUTpYDDmu/+3fb3:sQxaUCh93FxmuIE2tFG+pG/Y3

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

64.88.202.250:80

212.51.142.238:8080

200.55.243.138:8080

104.236.246.93:8080

61.19.246.238:443

79.45.112.220:80

95.213.236.64:8080

169.239.182.217:8080

103.86.49.11:8080

87.106.139.101:8080

74.208.45.104:8080

113.160.130.116:8443

209.141.54.221:8080

203.153.216.189:7080

73.11.153.178:8080

186.208.123.210:443

37.187.72.193:8080

201.173.217.124:443

121.124.124.40:7080

24.1.189.87:8080

rsa_pubkey.plain

Targets

- Target
  
  2025-03-07_429e0065875465913b84e3f2ce5e87a4_icedid_ramnit
- Size
  
  384KB
- MD5
  
  429e0065875465913b84e3f2ce5e87a4
- SHA1
  
  85a9b74a654d1dd0e7eb2eb690d17f36d8213bf2
- SHA256
  
  30841c3bddb578e1bef746343116fdbe85dfecd6064055cc927dc01374057ce5
- SHA512
  
  5d4d7edf4cb353e3d70a45a5f18891f91af6f97de025ccd744804f970eaaf39190c5901626d0887f64e126817f2a57928c703fb6ee8923bab87d88e90cd0495c
- SSDEEP
  
  6144:sU3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9YifJqCtc9HeGbfUTpYDDmu/+3fb3:sQxaUCh93FxmuIE2tFG+pG/Y3
Score

10^/10

emotet ramnit epoch2 banker discovery spyware stealer trojan upx worm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet family

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2