General

  • Target

    MsSpellCheckingFacility.bin

  • Size

    104KB

  • Sample

    200713-ssd5d6qpba

  • MD5

    b6830b6adf76aa6b4036f7c7456713ce

  • SHA1

    3063f03906f8823068cc4a8464b28f4c96e663d4

  • SHA256

    1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2

  • SHA512

    bf43839b157e1ba8eff983ae94ac53f14f2713f8bf0a2d38641fb941f14b7d56d25dddb09e19baa09e310ed7f780c2a374599d673c0cb57ee89eddf681310bdb

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.120.79.227:80

91.236.4.234:443

190.17.195.202:80

104.131.103.37:8080

190.147.137.153:443

186.3.232.68:80

190.163.1.31:8080

143.0.87.101:80

70.32.115.157:8080

177.66.190.130:80

82.196.15.205:8080

77.90.136.129:8080

175.114.178.83:443

46.28.111.142:7080

94.176.234.118:443

114.109.179.60:80

70.32.84.74:8080

172.104.169.32:8080

113.190.254.245:80

81.169.202.3:443

rsa_pubkey.plain

Targets

    • Target

      MsSpellCheckingFacility.bin

    • Size

      104KB

    • MD5

      b6830b6adf76aa6b4036f7c7456713ce

    • SHA1

      3063f03906f8823068cc4a8464b28f4c96e663d4

    • SHA256

      1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2

    • SHA512

      bf43839b157e1ba8eff983ae94ac53f14f2713f8bf0a2d38641fb941f14b7d56d25dddb09e19baa09e310ed7f780c2a374599d673c0cb57ee89eddf681310bdb

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks