emotet

General

Target

bc90fa0fa82d4193a5834f479ba3f473_JaffaCakes118
Size

392KB
Sample

240618-sehfkaydqa
MD5

bc90fa0fa82d4193a5834f479ba3f473
SHA1

2b7bfc53b1ada8bbe2c6d69726e94e0802d9ad50
SHA256

406c049d9f12cbde2173a80540d07a04b382598f8ca68f979ab819029b8deb84
SHA512

038ef754f72c0d99d33d07717727e80bc5fe4406f7c95c755035134ab701e8343e36c64df004e5b5d406ab19739ba6cb82b22d6667b68b02c93d6910ac917ec0
SSDEEP

6144:xsAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVtbrA:xZftkJjXCU8Z3cfoIEq

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

187.64.128.197:80

198.57.203.63:8080

163.172.107.70:8080

212.112.113.235:80

157.7.164.178:8081

181.167.35.84:80

212.156.133.218:80

185.142.236.163:443

181.143.101.19:8080

75.127.14.170:8080

115.165.3.213:80

190.55.233.156:80

139.59.12.63:8080

144.139.91.187:80

37.70.131.107:80

181.113.229.139:443

41.185.29.128:8080

177.37.81.212:443

5.79.70.250:8080

78.188.170.128:80

rsa_pubkey.plain

Targets

- Target
  
  bc90fa0fa82d4193a5834f479ba3f473_JaffaCakes118
- Size
  
  392KB
- MD5
  
  bc90fa0fa82d4193a5834f479ba3f473
- SHA1
  
  2b7bfc53b1ada8bbe2c6d69726e94e0802d9ad50
- SHA256
  
  406c049d9f12cbde2173a80540d07a04b382598f8ca68f979ab819029b8deb84
- SHA512
  
  038ef754f72c0d99d33d07717727e80bc5fe4406f7c95c755035134ab701e8343e36c64df004e5b5d406ab19739ba6cb82b22d6667b68b02c93d6910ac917ec0
- SSDEEP
  
  6144:xsAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVtbrA:xZftkJjXCU8Z3cfoIEq
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2