TSPY_EMOTET.AUSYYNR
Trojan.Emotet (Symantec); Emotet-FEA!166A3BA8EE51 (McAfee); W32.Trojan.Emotet(Webroot)
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
Arrival Details
This Spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Spyware drops and executes the following files:
- %System%\{random alphanumeric characters}.exe
- %System%\{filename 1}{filename 2}.exe
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Autostart Technique
This Spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\{filename 1}{filename 2}
ImagePath = %System%\{filename 1}{filename 2}.exe
Other Details
This Spyware connects to the following possibly malicious URL:
- http://{BLOCKED}3.{BLOCKED}5.217.114:443/
- http://{BLOCKED}6.{BLOCKED}0.105.121:8080/
- http://{BLOCKED}8.{BLOCKED}1.155.6:8080/
- http://{BLOCKED}0.{BLOCKED}1.139.203:8080/
- http://{BLOCKED}9.{BLOCKED}8.17.49:443/
- http://{BLOCKED}7.{BLOCKED}0.177.153:8080/
- http://{BLOCKED}4.{BLOCKED}8.246.9/
- http://{BLOCKED}.{BLOCKED}6.161.148/
- http://{BLOCKED}6.{BLOCKED}7.57.9/
- http://{BLOCKED}9.{BLOCKED}4.149.195:8080/
- http://{BLOCKED}5.{BLOCKED}5.76.121:8080/
- http://{BLOCKED}6.{BLOCKED}4.171.191:8080/
- http://{BLOCKED}1.{BLOCKED}4.217.195:8080/
- http://{BLOCKED}4.{BLOCKED}.205.55:7080/
- http://{BLOCKED}6.{BLOCKED}8.11.99:8080/
It deletes itself after execution.