General

  • Target

    1bec15857065f4860187cd4d4d800b906c726aab7b7eac5c2e00e1cd8f7436cf

  • Size

    522KB

  • Sample

    200124-8vep9729jn

  • MD5

    3a3dce819a8cda644efb3f48ff775729

  • SHA1

    c10e268a50ff7739eae4b892694302b04e52509d

  • SHA256

    1bec15857065f4860187cd4d4d800b906c726aab7b7eac5c2e00e1cd8f7436cf

  • SHA512

    a909a20833803e6f451024d28cc116c1be4cd01f53ad27c3a8f3651b7e186491668dabe9d96855bbd9d01a0bd3afb4a72b642e3caf2b4c211b3e13bd558bb841

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.200.47.120:443

144.139.228.113:443

189.78.156.8:80

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

188.216.24.204:80

200.82.170.231:80

78.46.87.133:8080

58.162.218.151:80

190.17.44.48:80

91.83.93.103:443

5.196.200.208:8080

68.174.15.223:80

177.103.157.126:80

113.61.76.239:80

186.15.52.123:80

79.7.114.1:80

186.68.48.204:443

rsa_pubkey.plain

Targets

    • Target

      1bec15857065f4860187cd4d4d800b906c726aab7b7eac5c2e00e1cd8f7436cf

    • Size

      522KB

    • MD5

      3a3dce819a8cda644efb3f48ff775729

    • SHA1

      c10e268a50ff7739eae4b892694302b04e52509d

    • SHA256

      1bec15857065f4860187cd4d4d800b906c726aab7b7eac5c2e00e1cd8f7436cf

    • SHA512

      a909a20833803e6f451024d28cc116c1be4cd01f53ad27c3a8f3651b7e186491668dabe9d96855bbd9d01a0bd3afb4a72b642e3caf2b4c211b3e13bd558bb841

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks