General

  • Target

    c04b22d2769a5a4fd37b22b455a593fbb6656023ec76b8ce812d98215f5c60f7

  • Size

    288KB

  • Sample

    191118-e4bkx6sv5s

  • MD5

    f7379dd5d814743774776d9418a0877c

  • SHA1

    9e07d16914b685519acb291b35ef652265087542

  • SHA256

    c04b22d2769a5a4fd37b22b455a593fbb6656023ec76b8ce812d98215f5c60f7

  • SHA512

    94d23ab7a5235695ac44df561e5280078e321ae71f65f4bee62611771e6abc4369b50d3139112699bd9e39a9192de67f2af95a4121e4012c4132e4b6495e5747

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

172.104.233.225:8080

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

87.106.77.40:7080

77.55.211.77:8080

201.190.133.235:8080

181.16.17.210:443

87.118.70.69:8080

45.79.95.107:443

111.119.233.65:80

138.68.106.4:7080

200.113.106.18:80

170.130.31.177:8080

91.83.93.124:7080

212.71.237.140:8080

76.69.29.42:80

50.28.51.143:8080

68.183.190.199:8080

190.146.131.105:8080

rsa_pubkey.plain

Targets

    • Target

      c04b22d2769a5a4fd37b22b455a593fbb6656023ec76b8ce812d98215f5c60f7

    • Size

      288KB

    • MD5

      f7379dd5d814743774776d9418a0877c

    • SHA1

      9e07d16914b685519acb291b35ef652265087542

    • SHA256

      c04b22d2769a5a4fd37b22b455a593fbb6656023ec76b8ce812d98215f5c60f7

    • SHA512

      94d23ab7a5235695ac44df561e5280078e321ae71f65f4bee62611771e6abc4369b50d3139112699bd9e39a9192de67f2af95a4121e4012c4132e4b6495e5747

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks