emotet_exe_e1_9fdbc4bc8a16975aaa693365507e28cfcc5f06b3c83c5e71f66ee7df49967f17_2020-11-17__181843.exe

General
Target

emotet_exe_e1_9fdbc4bc8a16975aaa693365507e28cfcc5f06b3c83c5e71f66ee7df49967f17_2020-11-17__181843.exe

Size

368KB

Sample

201117-4m4kvfa8wj

Score
10 /10
MD5

eba00b1db717c30cbe6ac601a33e1e77

SHA1

455298452dad5ef0601600373dd618819d6a08ef

SHA256

9fdbc4bc8a16975aaa693365507e28cfcc5f06b3c83c5e71f66ee7df49967f17

SHA512

3002f83e16033db7f8a90e5a2c75024e7162bb200d33816295abf19ffb695dfbdf7b849a62c5137444204ed9606c7b6e7e0b5933399b9fa62048fa4b2ccd6c52

Malware Config

Extracted

Family emotet
Botnet Epoch1
C2

177.107.79.214:8080

98.103.204.12:443

59.148.253.194:8080

172.86.186.21:8080

186.70.127.199:8090

201.213.177.139:80

177.23.7.151:80

12.162.84.2:8080

45.33.77.42:8080

200.59.6.174:80

62.84.75.50:80

201.49.239.200:443

202.134.4.210:7080

98.13.75.196:80

46.43.2.95:8080

177.129.17.170:443

152.169.22.67:80

138.97.60.141:7080

45.46.37.97:80

46.105.114.137:8080

37.183.81.217:80

191.97.154.2:80

177.73.0.98:443

186.103.141.250:443

181.58.181.9:80

109.190.249.106:80

189.223.16.99:80

175.143.12.123:8080

76.121.199.225:80

192.232.229.54:7080

192.241.143.52:8080

51.255.165.160:8080

74.135.120.91:80

181.129.96.162:8080

170.81.48.2:80

197.245.25.228:80

190.24.243.186:80

219.92.13.25:80

82.76.111.249:443

189.2.177.210:443

81.215.230.173:443

64.201.88.132:80

129.232.220.11:8080

209.236.123.42:8080

137.74.106.111:7080

201.71.228.86:80

46.101.58.37:8080

103.236.179.162:80

60.93.23.51:80

183.176.82.231:80

rsa_pubkey.plain
Targets
Target

emotet_exe_e1_9fdbc4bc8a16975aaa693365507e28cfcc5f06b3c83c5e71f66ee7df49967f17_2020-11-17__181843.exe

MD5

eba00b1db717c30cbe6ac601a33e1e77

Filesize

368KB

Score
10 /10
SHA1

455298452dad5ef0601600373dd618819d6a08ef

SHA256

9fdbc4bc8a16975aaa693365507e28cfcc5f06b3c83c5e71f66ee7df49967f17

SHA512

3002f83e16033db7f8a90e5a2c75024e7162bb200d33816295abf19ffb695dfbdf7b849a62c5137444204ed9606c7b6e7e0b5933399b9fa62048fa4b2ccd6c52

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10