General

  • Target

    f1c64bff70543fe447502109429bf85a54e5bfcf0af11637b9cc6c9010bc6a2c

  • Size

    440KB

  • Sample

    200124-eaz1wxynm2

  • MD5

    5441c34055f896ddb12dcfef0e1314a3

  • SHA1

    9cf4c7141d3fa65bd80465804048f6ad20739787

  • SHA256

    f1c64bff70543fe447502109429bf85a54e5bfcf0af11637b9cc6c9010bc6a2c

  • SHA512

    1d4566b4887c961de7ecc26d8e8513fb45c6549253c85b522c5e9f8d197c11ef38e33a09e79e381b1acf0e8c521665afc5da5ad6892d7c67b57790c7341e36ef

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.138.186.74:443

190.24.243.186:80

68.174.15.223:80

68.183.170.114:8080

45.79.95.107:443

192.241.143.52:8080

159.65.241.220:8080

142.93.114.137:8080

70.123.95.180:80

62.75.143.100:7080

91.242.136.103:80

109.169.86.13:8080

202.62.39.111:80

181.231.220.232:80

188.216.24.204:80

86.42.166.147:80

186.15.83.52:8080

178.79.163.131:8080

114.109.179.60:80

110.170.65.146:80

rsa_pubkey.plain

Targets

    • Target

      f1c64bff70543fe447502109429bf85a54e5bfcf0af11637b9cc6c9010bc6a2c

    • Size

      440KB

    • MD5

      5441c34055f896ddb12dcfef0e1314a3

    • SHA1

      9cf4c7141d3fa65bd80465804048f6ad20739787

    • SHA256

      f1c64bff70543fe447502109429bf85a54e5bfcf0af11637b9cc6c9010bc6a2c

    • SHA512

      1d4566b4887c961de7ecc26d8e8513fb45c6549253c85b522c5e9f8d197c11ef38e33a09e79e381b1acf0e8c521665afc5da5ad6892d7c67b57790c7341e36ef

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks