General

  • Target

    2e4a19ea05a6593c08ea41fcdaecd44847c8d7c6727964089ef2ecb2d11ddad8

  • Size

    344KB

  • Sample

    200127-aet7gsbana

  • MD5

    3e9ddbd15de2d0ded12c96e24cc5ce44

  • SHA1

    07aa06966246e2670e125daefbced5ebce9f779d

  • SHA256

    2e4a19ea05a6593c08ea41fcdaecd44847c8d7c6727964089ef2ecb2d11ddad8

  • SHA512

    c13c5fb55e98c5ecb354a5376ebc3ffbc46e06e2093eed6a1d7ccd31991b870ab7f9a1f6b696cde2aebb8a8b797021fceaad4dd1246432a18b37d87fa26799ec

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

207.177.72.129:8080

23.243.215.4:8080

218.255.173.106:80

136.243.205.112:7080

23.92.16.164:8080

45.55.65.123:8080

217.160.19.232:8080

64.66.6.71:8080

66.34.201.20:7080

85.152.174.56:80

202.175.121.202:8090

87.106.139.101:8080

176.9.43.37:8080

98.156.206.153:80

159.65.25.128:8080

70.184.9.39:8080

209.146.22.34:443

95.213.236.64:8080

98.30.113.161:80

59.103.164.174:80

rsa_pubkey.plain

Targets

    • Target

      2e4a19ea05a6593c08ea41fcdaecd44847c8d7c6727964089ef2ecb2d11ddad8

    • Size

      344KB

    • MD5

      3e9ddbd15de2d0ded12c96e24cc5ce44

    • SHA1

      07aa06966246e2670e125daefbced5ebce9f779d

    • SHA256

      2e4a19ea05a6593c08ea41fcdaecd44847c8d7c6727964089ef2ecb2d11ddad8

    • SHA512

      c13c5fb55e98c5ecb354a5376ebc3ffbc46e06e2093eed6a1d7ccd31991b870ab7f9a1f6b696cde2aebb8a8b797021fceaad4dd1246432a18b37d87fa26799ec

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks