General

  • Target

    7ee59d02da82fec9a9b72f81e2fe65c209c768ab0407e6c8760ce7a8170ee2e8

  • Size

    312KB

  • Sample

    191219-3r4v5xs316

  • MD5

    410801378a2d3210a560dc165aeaa1e7

  • SHA1

    641767937a0d8f45e2bf0b82793bcbb5dbd6e56d

  • SHA256

    7ee59d02da82fec9a9b72f81e2fe65c209c768ab0407e6c8760ce7a8170ee2e8

  • SHA512

    6db955550a18ce9ff160e3e2cd185c3e1021000a508b4af805ec8add280598d9df113612c6ed854ac7f61cf5f0f055d3605e6ec2fb9b0af2926879d51bb1c739

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

63.248.198.8:80

189.19.81.181:443

130.204.247.253:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

51.255.165.160:8080

118.36.70.245:80

190.210.184.138:995

188.135.15.49:80

139.162.118.88:8080

72.29.55.174:80

68.183.170.114:8080

181.231.62.54:80

192.241.146.84:8080

71.76.45.83:443

63.246.252.234:80

37.211.49.127:80

74.59.187.94:80

5.88.27.67:8080

rsa_pubkey.plain

Targets

    • Target

      7ee59d02da82fec9a9b72f81e2fe65c209c768ab0407e6c8760ce7a8170ee2e8

    • Size

      312KB

    • MD5

      410801378a2d3210a560dc165aeaa1e7

    • SHA1

      641767937a0d8f45e2bf0b82793bcbb5dbd6e56d

    • SHA256

      7ee59d02da82fec9a9b72f81e2fe65c209c768ab0407e6c8760ce7a8170ee2e8

    • SHA512

      6db955550a18ce9ff160e3e2cd185c3e1021000a508b4af805ec8add280598d9df113612c6ed854ac7f61cf5f0f055d3605e6ec2fb9b0af2926879d51bb1c739

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks