General

  • Target

    04067fd66ff1454509e2d8d42b8aa3b2648bcc64cb5b76d0dca4b8a544cd8443

  • Size

    336KB

  • Sample

    201020-vp649mgax2

  • MD5

    14cd5d93aed240ed7fae525f66982943

  • SHA1

    a88d995a955d2af9cf902d990dc6bcb2b3972103

  • SHA256

    04067fd66ff1454509e2d8d42b8aa3b2648bcc64cb5b76d0dca4b8a544cd8443

  • SHA512

    a280aed57587bc1228bdc1b789b6c3d16ea2b34bbfe182527e46550a21e316465380a6a374c1f9c67916d583304a483f950f5f69ab8f70217559e913b6050b77

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.230.141.169:80

72.249.144.95:8080

164.160.45.41:8080

120.150.218.241:443

118.83.154.64:443

61.33.119.226:443

66.76.12.94:8080

46.105.131.79:8080

83.110.223.58:443

185.94.252.104:443

75.143.247.51:80

130.0.132.242:80

203.153.216.189:7080

139.162.60.124:8080

176.111.60.55:8080

194.4.58.192:7080

134.209.36.254:8080

110.145.77.103:80

142.112.10.95:20

79.98.24.39:8080

rsa_pubkey.plain

Targets

    • Target

      04067fd66ff1454509e2d8d42b8aa3b2648bcc64cb5b76d0dca4b8a544cd8443

    • Size

      336KB

    • MD5

      14cd5d93aed240ed7fae525f66982943

    • SHA1

      a88d995a955d2af9cf902d990dc6bcb2b3972103

    • SHA256

      04067fd66ff1454509e2d8d42b8aa3b2648bcc64cb5b76d0dca4b8a544cd8443

    • SHA512

      a280aed57587bc1228bdc1b789b6c3d16ea2b34bbfe182527e46550a21e316465380a6a374c1f9c67916d583304a483f950f5f69ab8f70217559e913b6050b77

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks