General

  • Target

    aa7178d12e5a562cc1ca8198abb38cc6

  • Size

    219KB

  • Sample

    201117-7456zaphwj

  • MD5

    2bec474df208deff5b2a1ab3abbf59cf

  • SHA1

    47b9a954b6b37ca96622334ea19ff9572e5fc1c2

  • SHA256

    ef235aff234823368beb857ddd331cbbfb758d50138098dee45b1bea4c0ce6c1

  • SHA512

    b73e558d17485e9fcd419301787dc8f998d142a6ed989c7f8dc7f21df23ca41cfb9140d96df6026fb1754f91c23094b53bd03ebfda49977935bc4be157a33c22

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

67.163.161.107:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

185.94.252.104:443

110.142.236.207:80

194.187.133.160:443

218.147.193.146:80

172.104.97.173:8080

216.139.123.119:80

50.91.114.38:80

202.134.4.211:8080

113.61.66.94:80

139.99.158.11:443

62.171.142.179:8080

37.139.21.175:8080

190.108.228.27:443

94.23.237.171:443

154.91.33.137:443

201.241.127.190:80

rsa_pubkey.plain

Targets

    • Target

      aa7178d12e5a562cc1ca8198abb38cc6

    • Size

      219KB

    • MD5

      2bec474df208deff5b2a1ab3abbf59cf

    • SHA1

      47b9a954b6b37ca96622334ea19ff9572e5fc1c2

    • SHA256

      ef235aff234823368beb857ddd331cbbfb758d50138098dee45b1bea4c0ce6c1

    • SHA512

      b73e558d17485e9fcd419301787dc8f998d142a6ed989c7f8dc7f21df23ca41cfb9140d96df6026fb1754f91c23094b53bd03ebfda49977935bc4be157a33c22

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks