General

  • Target

    emotet_exe_e1_0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f_2020-11-17__192121._exe

  • Size

    492KB

  • Sample

    201117-6md2s7c3h2

  • MD5

    fcaa3a5bcb20281012d58b6b2274d3c7

  • SHA1

    2e9adff3bcf096a384bed776d001849cb3352d42

  • SHA256

    0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f

  • SHA512

    9dc44c5eef12cfd65601083689853c87a16b3f108a6bf092a021fc84252d4f88e85ef7415a7b9668c4202d99a76b6d2875da3b3a56f07aff01cf01e4f450a84e

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

197.245.25.228:80

98.103.204.12:443

59.148.253.194:8080

173.212.197.71:8080

87.106.46.107:8080

50.28.51.143:8080

177.73.0.98:443

213.197.182.158:8080

185.94.252.12:80

189.223.16.99:80

5.189.178.202:8080

186.103.141.250:443

181.129.96.162:8080

190.101.156.139:80

46.105.114.137:8080

51.15.7.145:80

98.13.75.196:80

202.134.4.210:7080

104.131.41.185:8080

181.123.6.86:80

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e1_0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f_2020-11-17__192121._exe

    • Size

      492KB

    • MD5

      fcaa3a5bcb20281012d58b6b2274d3c7

    • SHA1

      2e9adff3bcf096a384bed776d001849cb3352d42

    • SHA256

      0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f

    • SHA512

      9dc44c5eef12cfd65601083689853c87a16b3f108a6bf092a021fc84252d4f88e85ef7415a7b9668c4202d99a76b6d2875da3b3a56f07aff01cf01e4f450a84e

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks