General

  • Target

    c5a30ca5e7c3a45351d81bb4e4cd517d7f9d29300e2f2558e59c99a4f5015042

  • Size

    756KB

  • Sample

    200123-4bc14sq28j

  • MD5

    b0561eb4bf28e6c38be4bcce5ef52c15

  • SHA1

    1c369a18e45cd1e7eb1aecd6b1364532d0f8202b

  • SHA256

    c5a30ca5e7c3a45351d81bb4e4cd517d7f9d29300e2f2558e59c99a4f5015042

  • SHA512

    64be18f4edfe8b2cb08494e31252188673b4daf39573b5e39cc5168f22e7e375f9c89ee570a84b20ce818a593f91e547a405c0d209a88812e1a9a5cbe1af532f

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

72.176.87.136:80

150.246.246.238:80

202.229.211.95:80

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

185.207.57.205:443

192.241.220.183:8080

24.141.12.228:80

82.79.244.92:80

186.223.86.136:443

154.73.137.131:80

98.15.140.226:80

177.103.240.93:80

142.93.87.198:8080

158.69.167.246:8080

203.124.57.50:80

91.83.93.103:443

157.7.164.178:8081

rsa_pubkey.plain

Targets

    • Target

      c5a30ca5e7c3a45351d81bb4e4cd517d7f9d29300e2f2558e59c99a4f5015042

    • Size

      756KB

    • MD5

      b0561eb4bf28e6c38be4bcce5ef52c15

    • SHA1

      1c369a18e45cd1e7eb1aecd6b1364532d0f8202b

    • SHA256

      c5a30ca5e7c3a45351d81bb4e4cd517d7f9d29300e2f2558e59c99a4f5015042

    • SHA512

      64be18f4edfe8b2cb08494e31252188673b4daf39573b5e39cc5168f22e7e375f9c89ee570a84b20ce818a593f91e547a405c0d209a88812e1a9a5cbe1af532f

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks