Manuel Statik Analiz (LLM Okumali) — Emotet (Heodo) DLL Modulu | Tehdit: KRITIK

ファイル Kimligi

SHA2560452908a27eb9abf853e8d1b099322a77f2ecb4096be2648ef49ec1d5c9d6d45
EtiketHeodo (Emotet'in yeniden adlandirilmis hali)
Format32-bit Windows DLL
サイズ129.024 byte
String Sayisi506 (agir paketli)

Analiz Bulgulari

Bu ornek, Emotet'in modüler DLL mimarisinin bir parcasidir. Yuksek entropy ve dusuk string sayisi (506), guclu bir packer veya sifreleme katmaninin varligina isaret etmektedir. Statik string analizinde cleartext C2, URL veya email IOC bulunamadi.

Emotet アーキテクチャsi

  • Loader DLL: Ana modul, bellekte calisir, diskte nadir iz brakir
  • C2 Haberlesme: Sifreli HTTP POST, C2 listesi sablonlarda sakli
  • Modüler: Spambot, credential harvester, lateral movement modul'leri indirir
  • Payload Indirme: IcedID, Qakbot, Cobalt Strike gibi ikinci asama payload'lar yukler

Emotet Hakkinda

Emotet (ilk olarak 2014'te bir banking trojan olarak ortaya cikti), 2021'de Europol operasyonuyla kapatildi, ancak 2021 sonunda yeniden aktif hale geldi. Moduler yapisi sayesinde email spam gonderimi, credential theft ve enterprise networklerinde lateral movement gerceklestirebilir. Cobalt Strike ve ransomware ailelerinin birincil delivery mekanizmasindan biri olarak bilinir.

IOC

SHA2560452908a27eb9abf853e8d1b099322a77f2ecb4096be2648ef49ec1d5c9d6d45
Format32-bit DLL (modular component)
C2Bellekte cozulen sablonlanmis IP listesi

Emotet — マルウェアプロファイル

Emotet (Heodo/Mealybug/TA542) 32-bit DLL payload. Process enumeration via CreateToolhelp32Snapshot+Process32First/Next. VirtualAlloc+VirtualProtect shellcode staging. ntdll.dll direct calls. Low entropy 3.92 (stage-1 loader/encoded payload). Suspicious imagebase and DOS stub.

マルウェアの種類
Loader
プログラミング言語
C
C2プロトコル
HTTP
標的システム
Windows
別名 (AKA)
Heodo

技術詳細

C dili, HTTP C2 (RSA+AES sifreleme), modular yapi (email stealer, spreader, Outlook harvester), process hollowing, living off the land (regsvr32, mshta, certutil), Epoch1/2/3/4/5 botnet

アトリビューション / 脅威アクター

TA542 (MUMMY SPIDER) - Ukrayna kokenli oldugu dusunulen organizasyon. 2021'de Europol/FBI tarafindan coguyla tutuklandi; 2022'de geri dondu.

機能と挙動

Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı

IOCリスト (1 件の指標)

IOC — Emotet
# SHA256 0452908a27eb9abf853e8d1b099322a77f2ecb4096be2648ef49ec1d5c9d6d45
タイプ値メモ
sha256 0452908a27eb9abf853e8d1b099322a77f2ecb4096be2648ef49ec1d5c9d6d45
Emotet — 完全プロファイルへ →

C2サーバー (このファミリーで7台のサーバーを記録)

アドレス タイプ ポート プロトコル ステータス 国
41.216.188.11 ip 8000 HTTP active —
103.143.173.206 ip 443 HTTPS inactive ID
144.91.65.153 ip 7080 HTTP inactive DE
195.88.54.144 ip 8080 HTTP sinkholed —
103.43.46.149 ip 443 HTTPS sinkholed —
185.220.101.32 ip 80 HTTP sinkholed DE
5.135.183.154 ip 8080 HTTP sinkholed FR

C2アドレスはKEYDALチームが手動で検証したマルウェア検体のみに基づいて提供されています。商用利用は禁止です。

タグ
emotetheododllbanking-trojanenterpriseloadermodularpaketli