General

  • Target

    30de8c7dc8c76a42f2cb7e215586f975a0c660aad71d214c6d6cec7666a5d456

  • Size

    300KB

  • Sample

    200129-94qxyrqzca

  • MD5

    39fe815bbb6217fe238b1d1ae4d7b12d

  • SHA1

    0c1fc13874cdb63cf709bb000c4946a8a73831d9

  • SHA256

    30de8c7dc8c76a42f2cb7e215586f975a0c660aad71d214c6d6cec7666a5d456

  • SHA512

    426aacf8fce12cdafd0d68b8e4a02c7076a6936810774d1c5241b667af02b4d84fcf8674f62ba5913938c4666f6e5520568bce1a95822962e7634a5b3c392971

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

186.10.98.177:80

154.70.158.97:80

95.66.182.136:80

68.183.18.169:8080

178.62.75.204:8080

178.33.167.120:8080

144.76.56.36:8080

61.204.119.188:443

163.172.107.70:8080

156.155.163.232:80

91.117.31.181:80

153.183.25.24:80

110.2.118.164:80

195.250.143.182:80

162.154.175.215:80

50.116.78.109:8080

72.176.87.136:80

184.162.115.11:443

37.70.131.107:80

181.39.96.86:443

rsa_pubkey.plain

Targets

    • Target

      30de8c7dc8c76a42f2cb7e215586f975a0c660aad71d214c6d6cec7666a5d456

    • Size

      300KB

    • MD5

      39fe815bbb6217fe238b1d1ae4d7b12d

    • SHA1

      0c1fc13874cdb63cf709bb000c4946a8a73831d9

    • SHA256

      30de8c7dc8c76a42f2cb7e215586f975a0c660aad71d214c6d6cec7666a5d456

    • SHA512

      426aacf8fce12cdafd0d68b8e4a02c7076a6936810774d1c5241b667af02b4d84fcf8674f62ba5913938c4666f6e5520568bce1a95822962e7634a5b3c392971

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks