General

  • Target

    ebb3eb9a840c29a321bb2a6b0ca3c6c9716304a4ef95d9b6636196624d0ab62c

  • Size

    190KB

  • Sample

    191113-32pafbtm1n

  • MD5

    3d4a68bffea6c362c97a9f95d3e7fe1c

  • SHA1

    2f329ad33e6264a8611748c437b185a0d8fd420e

  • SHA256

    ebb3eb9a840c29a321bb2a6b0ca3c6c9716304a4ef95d9b6636196624d0ab62c

  • SHA512

    82399f3ff57649e2ab5d7fb5ab4b4f386862cede1280b94ea4f3ad069e6e01e2ac4830fba1f3ad088b3fcf212d82b500d9cd1b7e56686ff89e470377702b1434

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

81.2.235.48:443

104.238.80.237:8080

178.249.187.150:7080

124.150.175.129:8080

154.120.227.206:8080

187.177.155.123:990

95.216.207.86:7080

189.154.130.167:443

188.220.235.237:8080

95.216.212.157:8080

193.34.144.138:8080

187.147.152.244:8080

152.169.32.143:8080

181.47.235.26:993

50.116.78.109:8080

94.177.253.126:80

51.38.134.203:8080

192.241.220.183:8080

190.217.1.149:80

172.104.70.207:8080

rsa_pubkey.plain

Targets

    • Target

      ebb3eb9a840c29a321bb2a6b0ca3c6c9716304a4ef95d9b6636196624d0ab62c

    • Size

      190KB

    • MD5

      3d4a68bffea6c362c97a9f95d3e7fe1c

    • SHA1

      2f329ad33e6264a8611748c437b185a0d8fd420e

    • SHA256

      ebb3eb9a840c29a321bb2a6b0ca3c6c9716304a4ef95d9b6636196624d0ab62c

    • SHA512

      82399f3ff57649e2ab5d7fb5ab4b4f386862cede1280b94ea4f3ad069e6e01e2ac4830fba1f3ad088b3fcf212d82b500d9cd1b7e56686ff89e470377702b1434

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks