General

  • Target

    7a074a14e90f7ec193451e8ad95e90e15209829e25c6674787a39ec3d929c350

  • Size

    552KB

  • Sample

    191212-m7wxx39qq6

  • MD5

    8f541a91fd7c78192be1f640cc763219

  • SHA1

    255e942e70acb8bf743499b5c0e9775c9d3484b2

  • SHA256

    7a074a14e90f7ec193451e8ad95e90e15209829e25c6674787a39ec3d929c350

  • SHA512

    88e44f40fb3a92f90866f060a722e0ee3b6f28da79af08511e5f3096b23be56065f69af664f3441583a18dd3390655589d85a225d6600e8fce259ad6552d5b52

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

91.74.175.46:80

96.38.234.10:80

71.76.45.83:443

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

130.45.45.31:80

62.75.143.100:7080

142.93.114.137:8080

79.7.114.1:80

134.209.214.126:8080

68.183.190.199:8080

139.162.118.88:8080

212.71.237.140:8080

46.28.111.142:7080

181.231.62.54:80

200.124.225.32:80

73.167.135.180:80

200.119.11.118:443

rsa_pubkey.plain

Targets

    • Target

      7a074a14e90f7ec193451e8ad95e90e15209829e25c6674787a39ec3d929c350

    • Size

      552KB

    • MD5

      8f541a91fd7c78192be1f640cc763219

    • SHA1

      255e942e70acb8bf743499b5c0e9775c9d3484b2

    • SHA256

      7a074a14e90f7ec193451e8ad95e90e15209829e25c6674787a39ec3d929c350

    • SHA512

      88e44f40fb3a92f90866f060a722e0ee3b6f28da79af08511e5f3096b23be56065f69af664f3441583a18dd3390655589d85a225d6600e8fce259ad6552d5b52

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks