General

  • Target

    9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

  • Size

    408KB

  • Sample

    191120-9ane93lles

  • MD5

    119b1643346040f8fc33c924e7f707f4

  • SHA1

    4719bb0e333e904740c1689d1a8deb8754b34bb7

  • SHA256

    9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

  • SHA512

    4d03c70431fd0715cf8e1e6901fbba91e72f3812249531df5204874887e1da29fe28f60a9ae9f18e5d93f15905477e4e3ced83c0f143f3c78155d2f524dbdba5

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

198.58.120.26:8080

209.97.168.52:8080

37.187.2.199:443

149.202.197.94:8080

190.147.215.53:22

115.78.95.230:443

87.106.136.232:8080

186.4.172.5:8080

190.145.67.134:8090

83.136.245.190:8080

191.92.209.110:7080

190.211.207.11:443

5.196.74.210:8080

85.104.59.244:20

78.24.219.147:8080

190.53.135.159:21

211.63.71.72:8080

212.129.24.79:8080

165.227.156.155:443

182.176.132.213:8090

rsa_pubkey.plain

Targets

    • Target

      9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

    • Size

      408KB

    • MD5

      119b1643346040f8fc33c924e7f707f4

    • SHA1

      4719bb0e333e904740c1689d1a8deb8754b34bb7

    • SHA256

      9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

    • SHA512

      4d03c70431fd0715cf8e1e6901fbba91e72f3812249531df5204874887e1da29fe28f60a9ae9f18e5d93f15905477e4e3ced83c0f143f3c78155d2f524dbdba5

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks