General

  • Target

    c51158f36b3207f95fb7b10c2f8d337f

  • Size

    464KB

  • Sample

    201117-182wag3xns

  • MD5

    45fdea163abb9042d3b91fed12f04ebf

  • SHA1

    04405876d8e3c9c00cc41123581bc1729e088608

  • SHA256

    498850dc988a31691923eded24ac7c1252a0960ed4ecc1742c0d49ba66b003d7

  • SHA512

    364f7060cb5ac794bae250aa4720a0af9e3edb788a19810129fbc46e379a0b870333fb412403b643ece9aabdb202f98ece045d0bdcebc68563db185e8bb7c6b4

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

60.125.114.64:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

36.91.44.183:80

5.12.246.155:80

172.193.79.237:80

190.180.65.104:80

46.32.229.152:8080

58.27.215.3:8080

75.127.14.170:8080

198.20.228.9:8080

37.205.9.252:7080

120.51.34.254:80

41.185.29.128:8080

172.105.78.244:8080

175.103.38.146:80

190.164.135.81:80

183.91.3.63:80

109.13.179.195:80

rsa_pubkey.plain

Targets

    • Target

      c51158f36b3207f95fb7b10c2f8d337f

    • Size

      464KB

    • MD5

      45fdea163abb9042d3b91fed12f04ebf

    • SHA1

      04405876d8e3c9c00cc41123581bc1729e088608

    • SHA256

      498850dc988a31691923eded24ac7c1252a0960ed4ecc1742c0d49ba66b003d7

    • SHA512

      364f7060cb5ac794bae250aa4720a0af9e3edb788a19810129fbc46e379a0b870333fb412403b643ece9aabdb202f98ece045d0bdcebc68563db185e8bb7c6b4

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks