emotet

General

Target

bc66015e5e70fb001167fde7d98c9262_JaffaCakes118
Size

112KB
Sample

240618-rpstlsxdkf
MD5

bc66015e5e70fb001167fde7d98c9262
SHA1

c02c9cd9d4234692596cbf97e86888f321dbfcea
SHA256

439be11892fdd1df00d491de6ccddbc70debbbd4f038711ab553572ce670e89f
SHA512

9d889b451f5f23cfff7d9a3c429e70edeb910cc533d05c356a78ba102e284e25dcc6ffa202495874e73b63fc2e28e8b4f4ff05e90c997235c149813dae1b46a7
SSDEEP

1536:Q8nW7iPu2xpgFr70tCPaCfGAR+39K/UASDXinG6W9U1QbphrmUgwWW7iui:Qp7iHxWFrmCf5RixAmyS99phrmUuW+d

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.243.83.70:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

95.216.205.155:8080

50.116.78.109:8080

54.38.143.245:8080

113.160.248.110:80

115.176.16.221:80

223.17.215.76:80

202.188.218.82:80

172.96.190.154:8080

139.59.12.63:8080

181.95.133.104:80

74.208.173.91:8080

202.166.170.43:80

185.142.236.163:443

198.57.203.63:8080

185.86.148.68:443

88.247.58.26:80

rsa_pubkey.plain

Targets

- Target
  
  bc66015e5e70fb001167fde7d98c9262_JaffaCakes118
- Size
  
  112KB
- MD5
  
  bc66015e5e70fb001167fde7d98c9262
- SHA1
  
  c02c9cd9d4234692596cbf97e86888f321dbfcea
- SHA256
  
  439be11892fdd1df00d491de6ccddbc70debbbd4f038711ab553572ce670e89f
- SHA512
  
  9d889b451f5f23cfff7d9a3c429e70edeb910cc533d05c356a78ba102e284e25dcc6ffa202495874e73b63fc2e28e8b4f4ff05e90c997235c149813dae1b46a7
- SSDEEP
  
  1536:Q8nW7iPu2xpgFr70tCPaCfGAR+39K/UASDXinG6W9U1QbphrmUgwWW7iui:Qp7iHxWFrmCf5RixAmyS99phrmUuW+d
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2