General

  • Target

    f288681585ebd045167d4d97ffe3482ccbd5b11ceefa02df8350251fb74876f6

  • Size

    101KB

  • Sample

    191219-szqeqmyqfe

  • MD5

    8847fed01f82f2e793098f5c8264862c

  • SHA1

    582a362857fda3ce53620740243130a751dbf5ea

  • SHA256

    f288681585ebd045167d4d97ffe3482ccbd5b11ceefa02df8350251fb74876f6

  • SHA512

    26865a072fd4540f51f1921a8e66ee651c57c42905bbf6984af0587c4f4d784d43dd43f6da6f969d57f06dfc610b833ede9a194de52d5d5b2018db17cdb41471

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://laclinika.com/wp-admin/r42ar70/

exe.dropper

https://thechasermart.com/wp-admin/7u93/

exe.dropper

https://zamusicport.com/wp-content/Vmc/

exe.dropper

https://zaloshop.net/wp-admin/8j0827/

exe.dropper

https://www.leatherbyd.com/PHPMailer-master/q91l5u01353/

Extracted

Family

emotet

Botnet

Epoch1

C2

191.183.21.190:80

175.114.178.83:443

165.228.195.93:80

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

46.101.212.195:8080

2.45.112.134:80

77.55.211.77:8080

63.246.252.234:80

212.237.50.61:8080

125.99.61.162:7080

207.154.204.40:8080

200.119.11.118:443

190.186.164.23:80

219.75.66.103:80

37.183.121.32:80

149.62.173.247:8080

190.195.129.227:8090

rsa_pubkey.plain

Targets

    • Target

      f288681585ebd045167d4d97ffe3482ccbd5b11ceefa02df8350251fb74876f6

    • Size

      101KB

    • MD5

      8847fed01f82f2e793098f5c8264862c

    • SHA1

      582a362857fda3ce53620740243130a751dbf5ea

    • SHA256

      f288681585ebd045167d4d97ffe3482ccbd5b11ceefa02df8350251fb74876f6

    • SHA512

      26865a072fd4540f51f1921a8e66ee651c57c42905bbf6984af0587c4f4d784d43dd43f6da6f969d57f06dfc610b833ede9a194de52d5d5b2018db17cdb41471

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks