General

  • Target

    4fc0c617838ef6ff927fa5033731132a0b8104d712ae88fc4a21c92426ee92cd

  • Size

    612KB

  • Sample

    200728-ywk3z5669n

  • MD5

    12c6a59f3b8fa7d2a6ec0816b0635ee3

  • SHA1

    6d8bf56d8775106246d38370fcaf6c90ef68ba0f

  • SHA256

    4fc0c617838ef6ff927fa5033731132a0b8104d712ae88fc4a21c92426ee92cd

  • SHA512

    67d7a47e5bcd1a6a8e29b6f9912f1b2c4cf4012fc33cea27fddd9afa9166c4f82ccae6236fa097a137a494bceff012b797d057b99fc999ae4d0003e0dcdea48a

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

179.60.229.168:443

185.94.252.13:443

189.218.165.63:80

77.90.136.129:8080

217.199.160.224:7080

104.131.41.185:8080

2.47.112.152:80

185.94.252.27:443

186.250.52.226:8080

51.255.165.160:8080

68.183.170.114:8080

191.99.160.58:80

104.131.103.37:8080

181.31.211.181:80

202.62.39.111:80

83.169.21.32:7080

87.106.46.107:8080

72.47.248.48:7080

177.75.143.112:443

190.17.195.202:80

rsa_pubkey.plain

Targets

    • Target

      4fc0c617838ef6ff927fa5033731132a0b8104d712ae88fc4a21c92426ee92cd

    • Size

      612KB

    • MD5

      12c6a59f3b8fa7d2a6ec0816b0635ee3

    • SHA1

      6d8bf56d8775106246d38370fcaf6c90ef68ba0f

    • SHA256

      4fc0c617838ef6ff927fa5033731132a0b8104d712ae88fc4a21c92426ee92cd

    • SHA512

      67d7a47e5bcd1a6a8e29b6f9912f1b2c4cf4012fc33cea27fddd9afa9166c4f82ccae6236fa097a137a494bceff012b797d057b99fc999ae4d0003e0dcdea48a

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks