General

  • Target

    c22ea51a534169d3e2cbc391a502d2cf2e3d474be9ae2746250e595b55da7b92

  • Size

    488KB

  • Sample

    200214-39kghhf8y2

  • MD5

    1e25d09b70fe0a9433a5f5c939ae1474

  • SHA1

    515f34b30df2293716247d92e5b76f5b820b3704

  • SHA256

    c22ea51a534169d3e2cbc391a502d2cf2e3d474be9ae2746250e595b55da7b92

  • SHA512

    20bbc2b56896ead9048cb6e91e15aa5afe7a79fff38cf67f18000319210f304ad8a3d1221b2352d0818fa3200d9b1514942c3d10b422e13dc138eb1e3c9fb912

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

41.60.202.26:443

147.83.10.59:80

91.236.4.234:443

104.131.41.185:8080

190.57.130.142:443

72.47.248.48:7080

73.239.11.159:80

191.103.76.34:443

61.92.159.208:8080

68.183.170.114:8080

181.10.204.106:80

94.76.247.61:8080

89.19.20.202:443

191.183.21.190:80

110.145.101.66:443

186.250.113.201:80

217.199.160.224:8080

200.127.51.94:80

181.60.244.48:8080

190.219.149.236:80

rsa_pubkey.plain

Targets

    • Target

      c22ea51a534169d3e2cbc391a502d2cf2e3d474be9ae2746250e595b55da7b92

    • Size

      488KB

    • MD5

      1e25d09b70fe0a9433a5f5c939ae1474

    • SHA1

      515f34b30df2293716247d92e5b76f5b820b3704

    • SHA256

      c22ea51a534169d3e2cbc391a502d2cf2e3d474be9ae2746250e595b55da7b92

    • SHA512

      20bbc2b56896ead9048cb6e91e15aa5afe7a79fff38cf67f18000319210f304ad8a3d1221b2352d0818fa3200d9b1514942c3d10b422e13dc138eb1e3c9fb912

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks