Genel Bakis

Bu ornek, dosya adi EmotetPayload32-bitDL olarak etiketlenmis 333KB buyuklugunde bir Emotet 32-bit DLL Payload'dir. Emotet, 2014'ten bu yana aktif olan, dunya genelinde bankaci trojan, spam gonderici ve ikincil payload yukleyici olarak kullanilan en tehlikeli malware ailelerinden biridir. FBI ve CISA tarafindan pek cok kez kritik tehdit olarak siniflandirilmistir.

Emotet Hakkinda

  • Ilk olarak 2014'te bankacilik trojan olarak ortaya cikti
  • Sonraki surumler: spam botnet, dropper/loader, C2 moduler mimarisi
  • 2021'de Europol operasyonuyla cokertildi; 2021 sonunda yeniden aktif
  • 2022-2023: Epoch 4 ve Epoch 5 olarak iki farkli C2 altyapisinda
  • Ikincil yuk: TrickBot, QakBot, Cobalt Strike, ransomware

Teknik Analiz

DLL Payload Ozellikleri

  • Format: PE32 GUI Intel 80386 (32-bit DLL)
  • Taille: 333.312 bayt
  • Entropi: 6.68 (normal)
  • Section sayisi: 5 (.text, .data, .idata, .rsrc, .reloc)

Gizleme Teknigi

  • Tum anlamli string'ler sifrelenmis/obfuske
  • Gorunen stringler yalnizca Windows CRT kayit mesajlari (connection refused, not_a_socket, text file busy)
  • Locale stringleri (zh-CHT, syr-SY, sr-BA-Cyrl, ti-ET, st-ZA) — locale-based obfuscation
  • Export tablosu bos (cagri adresleri runtime'da cozulur)

Emotet C2 Architecturesi (Genel)

  • C2 adresleri sifrelenmis PE kaynaginda sakli (RSA + custom encoding)
  • Moduler mimari: spam, spreader, loader, credential harvester modulleri
  • HTTPS + port cesitliligi (7080, 8080, 443, 80)
  • Process injection: svchost.exe veya Windows islemleri icine

Teknik Ozellikler

OzellikValeur
FamilleEmotet
Tur32-bit DLL Payload
FormatPE32 GUI Intel 80386
Taille333.312 bayt
C2Sifrelenmis (RSA)
Ikincil YuklerTrickBot, QakBot, Cobalt Strike

IOC Ozeti

  • SHA256: ce742b7cc94a5c668116d343b6a9677523dc13b358294bba3cd248fba8b880da
  • Fichier: EmotetPayload32-bitDL

Emotet — Profil du malware

Emotet (Heodo/Mealybug/TA542) 32-bit DLL payload. Process enumeration via CreateToolhelp32Snapshot+Process32First/Next. VirtualAlloc+VirtualProtect shellcode staging. ntdll.dll direct calls. Low entropy 3.92 (stage-1 loader/encoded payload). Suspicious imagebase and DOS stub.

Type de malware
Loader
Langage de programmation
C
Protocole C2
HTTP
Systèmes ciblés
Windows
Aussi connu sous (AKA)
Heodo

Détails techniques

C dili, HTTP C2 (RSA+AES sifreleme), modular yapi (email stealer, spreader, Outlook harvester), process hollowing, living off the land (regsvr32, mshta, certutil), Epoch1/2/3/4/5 botnet

Attribution / Acteur de la menace

TA542 (MUMMY SPIDER) - Ukrayna kokenli oldugu dusunulen organizasyon. 2021'de Europol/FBI tarafindan coguyla tutuklandi; 2022'de geri dondu.

Capacités et comportement

Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı

Liste IOC (1 indicateurs)

IOC — Emotet
# SHA256 ce742b7cc94a5c668116d343b6a9677523dc13b358294bba3cd248fba8b880da
TypeValeurNote
sha256 ce742b7cc94a5c668116d343b6a9677523dc13b358294bba3cd248fba8b880da
Emotet — Voir le profil complet →

Serveurs C2 (7 serveurs enregistrés pour cette famille)

Adresse Type Port Protocole Statut Pays
41.216.188.11 ip 8000 HTTP active —
103.143.173.206 ip 443 HTTPS inactive ID
144.91.65.153 ip 7080 HTTP inactive DE
195.88.54.144 ip 8080 HTTP sinkholed —
103.43.46.149 ip 443 HTTPS sinkholed —
185.220.101.32 ip 80 HTTP sinkholed DE
5.135.183.154 ip 8080 HTTP sinkholed FR

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.

Tags
emotetdllpayloadbotnetloaderdroppertrickbotqakbotcobalt-strikec2rsaencryptedmodularspamspreader