General

  • Target

    ccd4098aa7eb1355adab2be5ecdd8601b560017b28e08a4ebe9cf68e4e6ee963

  • Size

    745KB

  • Sample

    191218-ggfq94fqbj

  • MD5

    b14323668badac52b50a5c6fb46f3577

  • SHA1

    d7380861473d1b84294d6416c4db12a73398d679

  • SHA256

    ccd4098aa7eb1355adab2be5ecdd8601b560017b28e08a4ebe9cf68e4e6ee963

  • SHA512

    c3644551c4e8da7d24d4c664fa57fc43a436d4a35536c00a2b80da7a1be9d5264e59f749c97b4319d439326f237aea67ab797ce7b8939e43a7bdcf13ca629f3f

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

66.229.161.86:443

190.47.236.83:80

217.12.70.226:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

95.216.207.86:7080

128.92.54.20:80

185.192.75.240:443

41.77.74.214:443

190.38.252.45:443

124.150.175.129:8080

191.100.24.201:50000

178.134.1.238:80

72.51.153.27:80

210.224.65.117:80

83.156.88.159:80

190.171.135.235:80

100.38.11.243:80

rsa_pubkey.plain

Targets

    • Target

      ccd4098aa7eb1355adab2be5ecdd8601b560017b28e08a4ebe9cf68e4e6ee963

    • Size

      745KB

    • MD5

      b14323668badac52b50a5c6fb46f3577

    • SHA1

      d7380861473d1b84294d6416c4db12a73398d679

    • SHA256

      ccd4098aa7eb1355adab2be5ecdd8601b560017b28e08a4ebe9cf68e4e6ee963

    • SHA512

      c3644551c4e8da7d24d4c664fa57fc43a436d4a35536c00a2b80da7a1be9d5264e59f749c97b4319d439326f237aea67ab797ce7b8939e43a7bdcf13ca629f3f

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks