General

  • Target

    Docs_8f05c3158a5b919ecee4db5ccc5f18ba.16

  • Size

    185KB

  • Sample

    191218-tsqgqz8wcn

  • MD5

    8f05c3158a5b919ecee4db5ccc5f18ba

  • SHA1

    ab813bacbada06b02580be394030756383cd936c

  • SHA256

    7b8418e3fb1a5e4800d0fefdc6360543f071110e3d0e7a8de9fd4c160337e8f1

  • SHA512

    c30da68421efde2b89cfd8d44f2fe03eca6d4cb055803845dc35e2dd767d5a2fcff35834affded6cbf3158154da54c453f9c26db851a5f8f37ab8a95a7127c97

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://gobabynames.com/dz6r/xytx7/

exe.dropper

http://nhomkinhthienbinh.com/cgi-bin/yW/

exe.dropper

http://capitalcitycarwash.com/komldk65kd/7tz/

exe.dropper

http://compscischool.com/wp-content/8a1n/

exe.dropper

http://gianphoisonghong.com/wp-includes/AUWxwq1V2s/

Extracted

Family

emotet

Botnet

Epoch2

C2

173.247.19.238:80

174.81.132.128:80

211.44.35.111:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

104.131.11.150:8080

68.118.26.116:80

190.226.44.20:21

120.150.246.241:80

92.222.216.44:8080

73.214.99.25:80

110.142.38.16:80

24.93.212.32:80

190.53.135.159:21

66.209.97.122:8080

173.91.11.142:80

100.14.117.137:80

2.237.76.249:80

rsa_pubkey.plain

Targets

    • Target

      Docs_8f05c3158a5b919ecee4db5ccc5f18ba.16

    • Size

      185KB

    • MD5

      8f05c3158a5b919ecee4db5ccc5f18ba

    • SHA1

      ab813bacbada06b02580be394030756383cd936c

    • SHA256

      7b8418e3fb1a5e4800d0fefdc6360543f071110e3d0e7a8de9fd4c160337e8f1

    • SHA512

      c30da68421efde2b89cfd8d44f2fe03eca6d4cb055803845dc35e2dd767d5a2fcff35834affded6cbf3158154da54c453f9c26db851a5f8f37ab8a95a7127c97

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks