General

  • Target

    emotet_exe_e3_a41759e0b5656ec6d46c98e3830d2e1b1d025fb92489f14bff89283b00772725_2020-11-17__175433._exe

  • Size

    368KB

  • Sample

    201117-f2yy4tnqts

  • MD5

    81a77d54d5b09154b58dd6728ec46927

  • SHA1

    38228402a925c56d907706352a726aa75b61a62d

  • SHA256

    a41759e0b5656ec6d46c98e3830d2e1b1d025fb92489f14bff89283b00772725

  • SHA512

    60f0945c8af102b3dc78998a6f11b46599b3d76700ea9ae0ed52089a43f213b793000838cdd7bf8a8e43188d951a8bea2053f8d32cf1fe60fb89b55e6366f64b

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

78.90.78.210:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

120.51.34.254:80

85.246.78.192:80

139.59.12.63:8080

46.105.131.68:8080

5.2.246.108:80

60.108.128.186:80

190.55.186.229:80

47.154.85.229:80

188.80.27.54:80

115.79.59.157:80

91.75.75.46:80

119.92.77.17:80

109.13.179.195:80

190.151.5.131:443

5.79.70.250:8080

175.103.38.146:80

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e3_a41759e0b5656ec6d46c98e3830d2e1b1d025fb92489f14bff89283b00772725_2020-11-17__175433._exe

    • Size

      368KB

    • MD5

      81a77d54d5b09154b58dd6728ec46927

    • SHA1

      38228402a925c56d907706352a726aa75b61a62d

    • SHA256

      a41759e0b5656ec6d46c98e3830d2e1b1d025fb92489f14bff89283b00772725

    • SHA512

      60f0945c8af102b3dc78998a6f11b46599b3d76700ea9ae0ed52089a43f213b793000838cdd7bf8a8e43188d951a8bea2053f8d32cf1fe60fb89b55e6366f64b

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks