General

  • Target

    emotet_exe_e3_7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3_2020-11-17__175433._exe

  • Size

    838KB

  • Sample

    201117-axetgzvd9e

  • MD5

    5423cb04de5b9685a262595c3a1296c8

  • SHA1

    0d1653b11b23d210337575d9151d4b00645d8fff

  • SHA256

    7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3

  • SHA512

    a0ba56e3ea367a8951e19cb4372360b4165a47771353e4802287eba0cbae9560ca2ed0f2506320728ab7af4b8d0dd9e02f4d4a6ee14929efc8a9f687d76666b6

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

85.246.78.192:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

175.103.38.146:80

192.210.217.94:8080

180.23.53.200:80

202.29.237.113:8080

58.27.215.3:8080

190.85.46.52:7080

36.91.44.183:80

190.164.135.81:80

37.205.9.252:7080

192.241.220.183:8080

5.2.246.108:80

180.21.3.52:80

85.75.49.113:80

190.55.186.229:80

116.91.240.96:80

180.148.4.130:8080

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e3_7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3_2020-11-17__175433._exe

    • Size

      838KB

    • MD5

      5423cb04de5b9685a262595c3a1296c8

    • SHA1

      0d1653b11b23d210337575d9151d4b00645d8fff

    • SHA256

      7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3

    • SHA512

      a0ba56e3ea367a8951e19cb4372360b4165a47771353e4802287eba0cbae9560ca2ed0f2506320728ab7af4b8d0dd9e02f4d4a6ee14929efc8a9f687d76666b6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks