General

  • Target

    bdbccdfd7ad9a3d9b31c58ab6a9a2961c1b6c41e9f11b0fad5c3fdb699be772e

  • Size

    244KB

  • Sample

    200115-vlvvjaz3da

  • MD5

    4faa95cd99614f040fda54e082da709d

  • SHA1

    69ff0d4af28978ce65196c45acdf360a446e4da2

  • SHA256

    bdbccdfd7ad9a3d9b31c58ab6a9a2961c1b6c41e9f11b0fad5c3fdb699be772e

  • SHA512

    123cbefee5ac4a38a7206a16bf16a3b2bc15a1e7c5ddc6ff5a59dc709c61aa5ea74439bb7d2fd3798a8558372ee4b09c03425a6bac4e65066e3864b072211225

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.hgklighting.com/wp-admin/g0bm/

exe.dropper

http://thegioilap.vn/wp-content/EV/

exe.dropper

http://pilkom.ulm.ac.id/wp-content/r4iio/

exe.dropper

http://165.227.220.53/wp-includes/YEQ4r/

exe.dropper

https://jelajahpulautidung.com/t4ierwnn/8j/

Extracted

Family

emotet

Botnet

Epoch2

C2

66.7.242.50:8080

72.186.137.156:80

197.89.27.26:8080

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

78.24.219.147:8080

159.65.25.128:8080

95.128.43.213:8080

179.13.185.19:80

186.86.247.171:443

110.142.38.16:80

201.173.217.124:443

169.239.182.217:8080

211.63.71.72:8080

104.131.11.150:8080

190.55.181.54:443

209.146.22.34:443

64.53.242.181:8080

rsa_pubkey.plain

Targets

    • Target

      bdbccdfd7ad9a3d9b31c58ab6a9a2961c1b6c41e9f11b0fad5c3fdb699be772e

    • Size

      244KB

    • MD5

      4faa95cd99614f040fda54e082da709d

    • SHA1

      69ff0d4af28978ce65196c45acdf360a446e4da2

    • SHA256

      bdbccdfd7ad9a3d9b31c58ab6a9a2961c1b6c41e9f11b0fad5c3fdb699be772e

    • SHA512

      123cbefee5ac4a38a7206a16bf16a3b2bc15a1e7c5ddc6ff5a59dc709c61aa5ea74439bb7d2fd3798a8558372ee4b09c03425a6bac4e65066e3864b072211225

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks