emotet_exe_e2_04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38_2020-11-17__185524._exe

General
Target

emotet_exe_e2_04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38_2020-11-17__185524._exe

Size

666KB

Sample

201117-cgzrncxw7n

Score
10 /10
MD5

9cffa9a03f0ff4bc8b33151edfa104ed

SHA1

b8838a451ff5c4eae5d552e1a8316a697955c055

SHA256

04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38

SHA512

6b1476ed12ef7c7605b7c3313eeb7993cd9f8fe56a985557f9ade49db0d460d01fea98ef550401ebfffc5262da56b588c8498863ca81b74e5b5895310f782e12

Malware Config

Extracted

Family emotet
Botnet Epoch2
C2

75.188.96.231:80

72.10.36.104:8080

167.114.153.111:8080

72.249.144.95:8080

80.241.255.202:8080

71.72.196.159:80

164.160.45.41:8080

203.153.216.189:7080

185.94.252.104:443

142.112.10.95:20

61.19.246.238:443

220.245.198.194:80

37.139.21.175:8080

108.46.29.236:80

209.54.13.14:80

87.106.136.232:8080

87.106.139.101:8080

176.111.60.55:8080

130.0.132.242:80

94.200.114.161:80

47.144.21.12:443

139.162.60.124:8080

123.176.25.234:80

75.139.38.211:80

94.23.237.171:443

202.141.243.254:443

190.108.228.27:443

104.131.11.150:443

121.7.31.214:80

113.61.66.94:80

118.83.154.64:443

62.30.7.67:443

172.104.97.173:8080

68.252.26.78:80

89.216.122.92:80

46.105.131.79:8080

37.187.72.193:8080

124.41.215.226:80

91.211.88.52:7080

139.162.108.71:8080

72.143.73.234:443

61.33.119.226:443

89.121.205.18:80

109.74.5.95:8080

79.98.24.39:8080

78.24.219.147:8080

5.39.91.110:7080

62.75.141.82:80

93.147.212.206:80

209.141.54.221:7080

rsa_pubkey.plain
Targets
Target

emotet_exe_e2_04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38_2020-11-17__185524._exe

MD5

9cffa9a03f0ff4bc8b33151edfa104ed

Filesize

666KB

Score
10 /10
SHA1

b8838a451ff5c4eae5d552e1a8316a697955c055

SHA256

04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38

SHA512

6b1476ed12ef7c7605b7c3313eeb7993cd9f8fe56a985557f9ade49db0d460d01fea98ef550401ebfffc5262da56b588c8498863ca81b74e5b5895310f782e12

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10