General

  • Target

    56211d219a01b6d0c646482a545e1dbdce0e1ea6bf371915d4a28dcf47f693c4

  • Size

    201KB

  • Sample

    191218-75dmfvwpmn

  • MD5

    9776ed17c0496aa13add80f519ce74bb

  • SHA1

    5df6dfb6fdd9f3caa0c4408355bb3b1ff9be9c7d

  • SHA256

    56211d219a01b6d0c646482a545e1dbdce0e1ea6bf371915d4a28dcf47f693c4

  • SHA512

    ae898b3b8173b3b59a1333022f439e34fac743d54e51e0fda229dd328b941234e40b4663f3caf9ebe779efff68846a00680b47658a585c92947edf3a13692bd2

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://moisesdavid.com/qoong/vy/

exe.dropper

http://insurancebabu.com/wp-admin/iXElcu9f/

exe.dropper

http://rishi99.com/framework.impossible/dhADGeie6/

exe.dropper

https://www.alertpage.net/confirmation/2nX/

exe.dropper

https://anttarc.org/chartaxd/DMBuiwf5u/

Extracted

Family

emotet

Botnet

Epoch2

C2

1.215.28.101:8080

184.167.148.162:80

66.25.34.20:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

190.220.19.82:443

91.242.138.5:443

159.65.25.128:8080

61.197.110.214:80

110.143.84.202:80

95.128.43.213:8080

91.73.197.90:80

201.184.105.242:443

108.179.206.219:8080

181.57.193.14:80

188.152.7.140:80

139.130.241.252:443

197.254.221.174:80

rsa_pubkey.plain

Targets

    • Target

      56211d219a01b6d0c646482a545e1dbdce0e1ea6bf371915d4a28dcf47f693c4

    • Size

      201KB

    • MD5

      9776ed17c0496aa13add80f519ce74bb

    • SHA1

      5df6dfb6fdd9f3caa0c4408355bb3b1ff9be9c7d

    • SHA256

      56211d219a01b6d0c646482a545e1dbdce0e1ea6bf371915d4a28dcf47f693c4

    • SHA512

      ae898b3b8173b3b59a1333022f439e34fac743d54e51e0fda229dd328b941234e40b4663f3caf9ebe779efff68846a00680b47658a585c92947edf3a13692bd2

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks