General

  • Target

    e030c0bd45b14a9cd661eed11fc29957b082e1cf93d0c2a9c88b6cc0c83fe80d

  • Size

    38KB

  • Sample

    200214-nqsh3z6kwe

  • MD5

    8759c0e63a986d08224a8cb013cfca5f

  • SHA1

    59413bcde7929f4c4c28e7069f0a11c0ba273c5d

  • SHA256

    e030c0bd45b14a9cd661eed11fc29957b082e1cf93d0c2a9c88b6cc0c83fe80d

  • SHA512

    fc5200cd5e87c956fdf7cd861ab7ac140d092d068024da89f4b497dc4c451bfa70503193af9249f09e7779c257ef1f0c9b4fa3678e46b6e5bf9893d4dcddd081

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

41.60.202.26:443

147.83.10.59:80

91.236.4.234:443

104.131.41.185:8080

190.57.130.142:443

72.47.248.48:7080

73.239.11.159:80

191.103.76.34:443

61.92.159.208:8080

68.183.170.114:8080

181.10.204.106:80

94.76.247.61:8080

89.19.20.202:443

191.183.21.190:80

110.145.101.66:443

186.250.113.201:80

217.199.160.224:8080

200.127.51.94:80

181.60.244.48:8080

190.219.149.236:80

rsa_pubkey.plain

Targets

    • Target

      e030c0bd45b14a9cd661eed11fc29957b082e1cf93d0c2a9c88b6cc0c83fe80d

    • Size

      38KB

    • MD5

      8759c0e63a986d08224a8cb013cfca5f

    • SHA1

      59413bcde7929f4c4c28e7069f0a11c0ba273c5d

    • SHA256

      e030c0bd45b14a9cd661eed11fc29957b082e1cf93d0c2a9c88b6cc0c83fe80d

    • SHA512

      fc5200cd5e87c956fdf7cd861ab7ac140d092d068024da89f4b497dc4c451bfa70503193af9249f09e7779c257ef1f0c9b4fa3678e46b6e5bf9893d4dcddd081

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks