General

  • Target

    1bbf587f2db0aa38e5b4ed3ac7d5a00091213be777370ca0ef6cf9c449efc394

  • Size

    628KB

  • Sample

    191217-4gzthprnnj

  • MD5

    3abed4f594f7600863c933a820f4e27e

  • SHA1

    6fe39645c527fdfa9fcf0965bfb0b740dd615819

  • SHA256

    1bbf587f2db0aa38e5b4ed3ac7d5a00091213be777370ca0ef6cf9c449efc394

  • SHA512

    98255457dc53ccac0aa358c63964223de4d5bff992185c63d4181e64779bcdda854f8e763b0dc22cda958271856e66a0114c692d6cf4ac66ae3b8d20a7a65855

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.247.19.238:80

174.81.132.128:80

211.44.35.111:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

104.131.11.150:8080

68.118.26.116:80

190.226.44.20:21

120.150.246.241:80

92.222.216.44:8080

73.214.99.25:80

110.142.38.16:80

24.93.212.32:80

190.53.135.159:21

66.209.97.122:8080

173.91.11.142:80

100.14.117.137:80

2.237.76.249:80

rsa_pubkey.plain

Targets

    • Target

      1bbf587f2db0aa38e5b4ed3ac7d5a00091213be777370ca0ef6cf9c449efc394

    • Size

      628KB

    • MD5

      3abed4f594f7600863c933a820f4e27e

    • SHA1

      6fe39645c527fdfa9fcf0965bfb0b740dd615819

    • SHA256

      1bbf587f2db0aa38e5b4ed3ac7d5a00091213be777370ca0ef6cf9c449efc394

    • SHA512

      98255457dc53ccac0aa358c63964223de4d5bff992185c63d4181e64779bcdda854f8e763b0dc22cda958271856e66a0114c692d6cf4ac66ae3b8d20a7a65855

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks