General

  • Target

    f59c47e1d8c2b6e32a06db724589e5af206336ad385c986ec95c8bce066fe66b

  • Size

    132KB

  • Sample

    200128-z3nyx79yqx

  • MD5

    8cbcc9c5cb6e431f8721e67a1194d836

  • SHA1

    594869c82b8bd57df7d0c5a358c011f4e688a2d3

  • SHA256

    f59c47e1d8c2b6e32a06db724589e5af206336ad385c986ec95c8bce066fe66b

  • SHA512

    600f0b72d21452b84b1dc7b4d6d2f273885a48596a5c3755ea1a5a60848dab247aef8c19b5f88f422aa6ebb2522ca3cab82ac0c4009e50370407fb71ed4e469c

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

108.190.109.107:80

174.83.116.77:80

125.207.127.86:80

74.208.45.104:8080

136.243.205.112:7080

23.92.16.164:8080

45.55.65.123:8080

24.164.79.147:8080

88.249.120.205:80

91.73.197.90:80

60.250.78.22:443

90.69.145.210:8080

101.187.237.217:80

85.152.174.56:80

190.117.226.104:80

190.12.119.180:443

186.86.247.171:443

47.153.183.211:80

37.187.72.193:8080

181.13.24.82:80

rsa_pubkey.plain

Targets

    • Target

      f59c47e1d8c2b6e32a06db724589e5af206336ad385c986ec95c8bce066fe66b

    • Size

      132KB

    • MD5

      8cbcc9c5cb6e431f8721e67a1194d836

    • SHA1

      594869c82b8bd57df7d0c5a358c011f4e688a2d3

    • SHA256

      f59c47e1d8c2b6e32a06db724589e5af206336ad385c986ec95c8bce066fe66b

    • SHA512

      600f0b72d21452b84b1dc7b4d6d2f273885a48596a5c3755ea1a5a60848dab247aef8c19b5f88f422aa6ebb2522ca3cab82ac0c4009e50370407fb71ed4e469c

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks