General

  • Target

    e7100866617044d8125f62f1e03f8efe27f4f85818cf7a93db625c690f77075d

  • Size

    480KB

  • Sample

    200213-5r8sk7nxde

  • MD5

    cad034243356c62b3c3d05b9a4c471db

  • SHA1

    5350de4826b41a5b88ea1e8cf2292ea65795643a

  • SHA256

    e7100866617044d8125f62f1e03f8efe27f4f85818cf7a93db625c690f77075d

  • SHA512

    52fa8d8e8dd8608de68e3f185af6bf47a6e0bbc13c85705f82126884b8415c96845475b52f543d250e8390f804515e7ee9e9a7f947e057a0676b94d25b577208

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

71.126.247.90:80

98.239.119.52:80

80.86.91.91:8080

104.236.28.47:8080

47.155.214.239:443

180.92.239.110:8080

87.106.136.232:8080

76.104.80.47:80

173.16.62.227:80

92.222.216.44:8080

47.153.183.211:80

74.130.83.133:80

47.156.70.145:80

110.36.217.66:8080

160.16.215.66:8080

200.116.145.225:443

181.13.24.82:80

24.94.237.248:80

5.32.55.214:80

31.172.240.91:8080

rsa_pubkey.plain

Targets

    • Target

      e7100866617044d8125f62f1e03f8efe27f4f85818cf7a93db625c690f77075d

    • Size

      480KB

    • MD5

      cad034243356c62b3c3d05b9a4c471db

    • SHA1

      5350de4826b41a5b88ea1e8cf2292ea65795643a

    • SHA256

      e7100866617044d8125f62f1e03f8efe27f4f85818cf7a93db625c690f77075d

    • SHA512

      52fa8d8e8dd8608de68e3f185af6bf47a6e0bbc13c85705f82126884b8415c96845475b52f543d250e8390f804515e7ee9e9a7f947e057a0676b94d25b577208

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks