emotet

General

Target

29cd05be9c850a9630224eec8f5974ad_JaffaCakes118
Size

330KB
Sample

240707-hhtmwswdpr
MD5

29cd05be9c850a9630224eec8f5974ad
SHA1

74f9cfb47bacba737393e280fd77aa50f99bd722
SHA256

55e6d41d1e9fad0c9990ad7b5be00def0d122b20b62b429651810a8dbcc169e5
SHA512

dc3137a60f142e5dedf837ce44ad6f219575dd07a19659b149457b1b018f3f1ed64951e37c676258306cb4861da2570ee970263fb94187096465300dcc52deb3
SSDEEP

3072:ERq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:2q1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

109.99.146.210:8080

116.202.10.123:8080

172.96.190.154:8080

163.53.204.180:443

190.107.118.125:80

91.93.3.85:8080

185.142.236.163:443

115.79.195.246:80

120.51.34.254:80

192.210.217.94:8080

198.20.228.9:8080

91.75.75.46:80

54.38.143.245:8080

161.49.84.2:80

162.144.145.58:8080

178.33.167.120:8080

201.193.160.196:80

rsa_pubkey.plain

Targets

- Target
  
  29cd05be9c850a9630224eec8f5974ad_JaffaCakes118
- Size
  
  330KB
- MD5
  
  29cd05be9c850a9630224eec8f5974ad
- SHA1
  
  74f9cfb47bacba737393e280fd77aa50f99bd722
- SHA256
  
  55e6d41d1e9fad0c9990ad7b5be00def0d122b20b62b429651810a8dbcc169e5
- SHA512
  
  dc3137a60f142e5dedf837ce44ad6f219575dd07a19659b149457b1b018f3f1ed64951e37c676258306cb4861da2570ee970263fb94187096465300dcc52deb3
- SSDEEP
  
  3072:ERq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:2q1sFAwgwmBv3wnIgG4oAYxvU54eu
Score

10^/10

emotet epoch3 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2