General

  • Target

    56bc9b95c8bf76aa491d0e1a7e054b6a19e52f2a943037e9d55345fb7e021f9d

  • Size

    388KB

  • Sample

    200128-ej4e8wwwvx

  • MD5

    328a5de8e1c5ae4083f5745cb6507954

  • SHA1

    ad0454c74dfac3bb5941c0ec0abbb4978fa47153

  • SHA256

    56bc9b95c8bf76aa491d0e1a7e054b6a19e52f2a943037e9d55345fb7e021f9d

  • SHA512

    1c95073fe353a0dd421842b57b12db85be65e41ad75ea375a692b719cd5ccf01d0312456991bc4ae88ef09603e2d163905a4a12090a49e2127df5f965a1bdaeb

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

195.250.143.182:80

184.162.115.11:443

70.60.238.62:80

68.183.18.169:8080

178.62.75.204:8080

178.33.167.120:8080

144.76.56.36:8080

216.75.37.196:8080

78.189.165.52:8080

185.192.75.240:443

202.229.211.95:80

190.5.162.204:80

24.141.12.228:80

41.185.29.128:8080

192.210.217.94:8080

110.2.118.164:80

203.153.216.178:7080

37.70.131.107:80

75.86.6.174:80

122.176.116.57:443

rsa_pubkey.plain

Targets

    • Target

      56bc9b95c8bf76aa491d0e1a7e054b6a19e52f2a943037e9d55345fb7e021f9d

    • Size

      388KB

    • MD5

      328a5de8e1c5ae4083f5745cb6507954

    • SHA1

      ad0454c74dfac3bb5941c0ec0abbb4978fa47153

    • SHA256

      56bc9b95c8bf76aa491d0e1a7e054b6a19e52f2a943037e9d55345fb7e021f9d

    • SHA512

      1c95073fe353a0dd421842b57b12db85be65e41ad75ea375a692b719cd5ccf01d0312456991bc4ae88ef09603e2d163905a4a12090a49e2127df5f965a1bdaeb

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks