General

  • Target

    6e191adbadf714b45e08eade9d8c7ae9aacbf5d25bbd5691cc1913f66d6a9908

  • Size

    190KB

  • Sample

    191113-l9zr8jhwqn

  • MD5

    dfc2e3ae04be63909f5aba67cf00844f

  • SHA1

    91a1e9293564432b4b79c2de59d62419d1a544c6

  • SHA256

    6e191adbadf714b45e08eade9d8c7ae9aacbf5d25bbd5691cc1913f66d6a9908

  • SHA512

    e0b75ac9e06918273c04d3e2bf2b01f4c08e4bd1bc28bd7808f76cb820c0a6eaacff8ebfd9baef158a66d7419636af0a7d84f635d7f91f87e009cc10543e7d9b

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

81.2.235.48:443

104.238.80.237:8080

178.249.187.150:7080

124.150.175.129:8080

154.120.227.206:8080

187.177.155.123:990

95.216.207.86:7080

189.154.130.167:443

188.220.235.237:8080

95.216.212.157:8080

193.34.144.138:8080

187.147.152.244:8080

152.169.32.143:8080

181.47.235.26:993

50.116.78.109:8080

94.177.253.126:80

51.38.134.203:8080

192.241.220.183:8080

190.217.1.149:80

172.104.70.207:8080

rsa_pubkey.plain

Targets

    • Target

      6e191adbadf714b45e08eade9d8c7ae9aacbf5d25bbd5691cc1913f66d6a9908

    • Size

      190KB

    • MD5

      dfc2e3ae04be63909f5aba67cf00844f

    • SHA1

      91a1e9293564432b4b79c2de59d62419d1a544c6

    • SHA256

      6e191adbadf714b45e08eade9d8c7ae9aacbf5d25bbd5691cc1913f66d6a9908

    • SHA512

      e0b75ac9e06918273c04d3e2bf2b01f4c08e4bd1bc28bd7808f76cb820c0a6eaacff8ebfd9baef158a66d7419636af0a7d84f635d7f91f87e009cc10543e7d9b

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks