General

  • Target

    931e76dc7bca18e1e72a7723a845ea5d717df439b9714c357e1b5ffcafe31713

  • Size

    64KB

  • Sample

    200728-ypl5d4vvae

  • MD5

    2fd14413c7eab0f3113a279ca40a0608

  • SHA1

    fb404700dca7f419d1d0250ec8a2d3848c6e35cd

  • SHA256

    931e76dc7bca18e1e72a7723a845ea5d717df439b9714c357e1b5ffcafe31713

  • SHA512

    77d23ec02930076e5591ccc9af306b7d3395649d5f66a238bf7ee94b9a0c42ba5568b4d1175129f68d14e6723e16d7236f584d9c9e1cf7898a8ab3b8bcf1fb29

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

76.27.179.47:80

212.51.142.238:8080

189.212.199.126:443

61.19.246.238:443

162.154.38.103:80

91.211.88.52:7080

83.110.223.58:443

124.45.106.173:443

116.203.32.252:8080

109.117.53.230:443

5.196.74.210:8080

75.139.38.211:80

168.235.67.138:7080

176.111.60.55:8080

169.239.182.217:8080

74.208.45.104:8080

31.31.77.83:443

222.214.218.37:4143

37.139.21.175:8080

91.205.215.66:443

rsa_pubkey.plain

Targets

    • Target

      931e76dc7bca18e1e72a7723a845ea5d717df439b9714c357e1b5ffcafe31713

    • Size

      64KB

    • MD5

      2fd14413c7eab0f3113a279ca40a0608

    • SHA1

      fb404700dca7f419d1d0250ec8a2d3848c6e35cd

    • SHA256

      931e76dc7bca18e1e72a7723a845ea5d717df439b9714c357e1b5ffcafe31713

    • SHA512

      77d23ec02930076e5591ccc9af306b7d3395649d5f66a238bf7ee94b9a0c42ba5568b4d1175129f68d14e6723e16d7236f584d9c9e1cf7898a8ab3b8bcf1fb29

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks