General

  • Target

    4f7399f069c7c2b07026cc242e7beff57ef1e79716cb27995a43a46d05d1391e

  • Size

    264KB

  • Sample

    200121-tpav6rjqns

  • MD5

    8de8c080ff1afcd35cddfc6cc2a11725

  • SHA1

    34ec5c4a5ef7861a86776a46c6ce821f1d3d9435

  • SHA256

    4f7399f069c7c2b07026cc242e7beff57ef1e79716cb27995a43a46d05d1391e

  • SHA512

    ef01a21c675d1bd09937691b4040c08351af8c75d2ef7728120abe2f44d4c976ede93acc76d2531d80e51bce964c4759b56c82d5f0854eb328b7bc467865a055

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

81.214.253.80:443

98.15.140.226:80

180.33.71.88:80

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

196.6.119.137:80

82.79.244.92:80

175.181.7.188:80

183.87.40.21:8080

201.183.251.100:80

91.73.169.210:80

188.251.213.180:443

110.142.161.90:80

177.144.130.105:443

106.248.79.174:80

70.45.30.28:80

187.72.47.161:443

185.244.167.25:443

rsa_pubkey.plain

Targets

    • Target

      4f7399f069c7c2b07026cc242e7beff57ef1e79716cb27995a43a46d05d1391e

    • Size

      264KB

    • MD5

      8de8c080ff1afcd35cddfc6cc2a11725

    • SHA1

      34ec5c4a5ef7861a86776a46c6ce821f1d3d9435

    • SHA256

      4f7399f069c7c2b07026cc242e7beff57ef1e79716cb27995a43a46d05d1391e

    • SHA512

      ef01a21c675d1bd09937691b4040c08351af8c75d2ef7728120abe2f44d4c976ede93acc76d2531d80e51bce964c4759b56c82d5f0854eb328b7bc467865a055

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks