emotet

General

Target

bcc7fe06da896c277e54efdbbaae81ce_JaffaCakes118
Size

148KB
Sample

240618-te7k5avbqq
MD5

bcc7fe06da896c277e54efdbbaae81ce
SHA1

1315f852affa3d38f68654609910833220988edf
SHA256

83062af835be6a8826d71067e91a2f012fcb0f0f4ece99ecba5012142b149d8e
SHA512

e67fa360204df42baa4cb85270bf4213eaf84e78633ee53dac3d123261ce96e0064d5a004b2928543905c11bf4d356bb19a92fe7ffd21ab3c79e278ded91ae14
SSDEEP

3072:l+WvAyXvCwcoUQ1T9UIfSrkkSDpHr3ucO:lBr7cENyk5LBO

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.243.83.70:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

95.216.205.155:8080

50.116.78.109:8080

54.38.143.245:8080

113.160.248.110:80

115.176.16.221:80

223.17.215.76:80

202.188.218.82:80

172.96.190.154:8080

139.59.12.63:8080

181.95.133.104:80

74.208.173.91:8080

202.166.170.43:80

185.142.236.163:443

198.57.203.63:8080

185.86.148.68:443

88.247.58.26:80

rsa_pubkey.plain

Targets

- Target
  
  bcc7fe06da896c277e54efdbbaae81ce_JaffaCakes118
- Size
  
  148KB
- MD5
  
  bcc7fe06da896c277e54efdbbaae81ce
- SHA1
  
  1315f852affa3d38f68654609910833220988edf
- SHA256
  
  83062af835be6a8826d71067e91a2f012fcb0f0f4ece99ecba5012142b149d8e
- SHA512
  
  e67fa360204df42baa4cb85270bf4213eaf84e78633ee53dac3d123261ce96e0064d5a004b2928543905c11bf4d356bb19a92fe7ffd21ab3c79e278ded91ae14
- SSDEEP
  
  3072:l+WvAyXvCwcoUQ1T9UIfSrkkSDpHr3ucO:lBr7cENyk5LBO
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2