General

  • Target

    a2a81df5ddef818772d0d86cf9da75ac5a6169cd807b6fc1e98d175e5bd2d91e

  • Size

    202KB

  • Sample

    191113-p9n1p8yw1j

  • MD5

    9de2c1c1d502de6c3a6538d855edf1c0

  • SHA1

    8b42d44006f29d0647dcb541e5fc3a890d38ea71

  • SHA256

    a2a81df5ddef818772d0d86cf9da75ac5a6169cd807b6fc1e98d175e5bd2d91e

  • SHA512

    9d7d662d0727f833a0088d667ac3ae390f6e41f170f1eaa41c607c9a0c68911d5be597332b37fe17108c0cad6bfcfe1bea80e9b52bbd48cf99c3a44c3599efcb

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

189.141.224.163:443

186.15.83.52:8080

173.212.220.251:443

170.130.31.177:8080

51.255.165.160:8080

154.120.227.206:8080

82.196.15.205:8080

86.42.166.147:80

200.113.106.18:80

109.169.86.13:8080

41.75.135.93:7080

142.93.114.137:8080

46.28.111.142:7080

163.172.40.218:7080

91.204.163.19:8090

42.190.4.92:443

76.69.29.42:80

201.163.74.202:443

178.79.163.131:8080

190.97.30.167:990

rsa_pubkey.plain

Targets

    • Target

      a2a81df5ddef818772d0d86cf9da75ac5a6169cd807b6fc1e98d175e5bd2d91e

    • Size

      202KB

    • MD5

      9de2c1c1d502de6c3a6538d855edf1c0

    • SHA1

      8b42d44006f29d0647dcb541e5fc3a890d38ea71

    • SHA256

      a2a81df5ddef818772d0d86cf9da75ac5a6169cd807b6fc1e98d175e5bd2d91e

    • SHA512

      9d7d662d0727f833a0088d667ac3ae390f6e41f170f1eaa41c607c9a0c68911d5be597332b37fe17108c0cad6bfcfe1bea80e9b52bbd48cf99c3a44c3599efcb

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks