Statik Analiz — Emotet Payload DLL | Tehdit: KRITIK
文件 Kimligi
| SHA256 | e8444339164268d9950b137d7a23f09eb213b9e9fedb7d4a025b5f1075e3929c |
|---|---|
| 文件 | EmotetPayload32-bitDL (MalwareBazaar ismi) |
| 大小 | 193,536 byte (PE32 DLL x86, 4 sections) |
| Entropi | 3.920 (dusuk -- stage-1 loader veya sifresiz veri) |
| Imagebase | Suspicious |
| DOS stub | Suspicious |
Emotet Epoch Servisi: Tarihce
EMOTET: MalwareBazaar etiketiyle "EmotetPayload32-bitDL" -- tescilli Emotet botnet payload!
-- Emotet (Mealybug/Heodo/TA542): 2014-gunumuz aktif botnet\n-- Epoch1, Epoch2, Epoch3: Emotet ag bolumu/suru sistemi\n-- 32-bit DLL payload: Emotet loader mimarisi (regsvr32 veya rundll32)\n-- Dusuk entropi (3.92): sifresiz C kod veya XOR-steganografi\n-- ntdll.dll qsort/bsearch: surelis veri islemesi (kriptografi/arama)\n-- Suspicious imagebase + DOS stub: manuel PE yapimi gostergesi
Process Enumeration: Kurban Profili
KERNEL32.dll -> CreateToolhelp32Snapshot\nKERNEL32.dll -> Process32First\nKERNEL32.dll -> Process32Next\n\n-- CreateToolhelp32Snapshot: sistemdeki tum prosesleri listele\n-- Process32First + Process32Next: listeyi dolas\n-- Emotet kullanimi:\n 1. Sandbox/analiz araclarini tespit et (procmon, wireshark, sandboxie)\n 2. Hedef prosesleri bul (Outlook, Chrome) veri calma icin\n 3. Enjeksiyon hedefini sec (explorer.exe, svchost.exe)
Guvenlik ve Bellek Yonetimi
KERNEL32.dll -> VirtualAlloc\nKERNEL32.dll -> VirtualFree\nKERNEL32.dll -> VirtualProtect\nntdll.dll -> qsort, bsearch, wcslen\n\n-- VirtualAlloc + VirtualProtect: shellcode veya payload icin bellek hazirla\n-- ntdll dogrudan cagirma: KERNEL32 bypass denemeleri\n-- qsort/bsearch: veri siralamasi (C2 adres listesi siralamalari?)
IOC
| SHA256 | e8444339164268d9950b137d7a23f09eb213b9e9fedb7d4a025b5f1075e3929c |
|---|---|
| Tip | PE32 DLL (32-bit) -- Emotet payload |
| Etiket | EmotetPayload32-bitDL (MalwareBazaar dogrulama) |
| Process enum | CreateToolhelp32Snapshot + Process32First/Next |
| Bellek | VirtualAlloc + VirtualProtect (shellcode inject) |
Emotet — 恶意软件档案
Emotet (Heodo/Mealybug/TA542) 32-bit DLL payload. Process enumeration via CreateToolhelp32Snapshot+Process32First/Next. VirtualAlloc+VirtualProtect shellcode staging. ntdll.dll direct calls. Low entropy 3.92 (stage-1 loader/encoded payload). Suspicious imagebase and DOS stub.
恶意软件类型
Loader
编程语言
C
C2协议
HTTP
目标系统
Windows
别名 (AKA)
Heodo
技术细节
C dili, HTTP C2 (RSA+AES sifreleme), modular yapi (email stealer, spreader, Outlook harvester), process hollowing, living off the land (regsvr32, mshta, certutil), Epoch1/2/3/4/5 botnet
归因 / 威胁行为者
TA542 (MUMMY SPIDER) - Ukrayna kokenli oldugu dusunulen organizasyon. 2021'de Europol/FBI tarafindan coguyla tutuklandi; 2022'de geri dondu.
能力与行为
Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı
IOC列表 (1 个指标)
IOC — Emotet
# SHA256
e8444339164268d9950b137d7a23f09eb213b9e9fedb7d4a025b5f1075e3929c
| 类型 | 值 | 备注 |
|---|---|---|
| sha256 | e8444339164268d9950b137d7a23f09eb213b9e9fedb7d4a025b5f1075e3929c |
C2服务器 (该家族共有 7 台已记录服务器)
| 地址 | 类型 | 端口 | 协议 | 状态 | 国家 |
|---|---|---|---|---|---|
| 41.216.188.11 | ip | 8000 | HTTP | active | — |
| 103.143.173.206 | ip | 443 | HTTPS | inactive | ID |
| 144.91.65.153 | ip | 7080 | HTTP | inactive | DE |
| 195.88.54.144 | ip | 8080 | HTTP | sinkholed | — |
| 103.43.46.149 | ip | 443 | HTTPS | sinkholed | — |
| 185.220.101.32 | ip | 80 | HTTP | sinkholed | DE |
| 5.135.183.154 | ip | 8080 | HTTP | sinkholed | FR |
C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。