General

  • Target

    dfa8eac5d28ddebc960a1035af22c2b0

  • Size

    456KB

  • Sample

    201117-hfc5g7wyfs

  • MD5

    428820e4c4682fb5e10e0b414334b481

  • SHA1

    e0d56e368e1a7dbe8592366f94f89e21016b7046

  • SHA256

    bd6500d97936a3479cd8cea0dc480c8da59d4bb34a2e72c352d346a8070ebcea

  • SHA512

    5122cb94e4eb880c52e5dd61e655271fd5945e0a14c9d81d586cc34e8e91d31b9067f3e21e61ca25cb5de8cfde71db87f0b691d4ecc38862b510a73de2a7e54b

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

78.206.229.130:80

104.131.92.244:8080

70.39.251.94:8080

87.230.25.43:8080

79.118.74.90:80

82.76.111.249:443

82.76.52.155:80

212.71.237.140:8080

188.251.213.180:80

103.236.179.162:80

1.226.84.243:8080

70.32.84.74:8080

2.84.12.98:80

201.213.177.139:80

177.73.0.98:443

170.81.48.2:80

129.232.220.11:8080

177.144.130.105:8080

213.52.74.198:80

120.72.18.91:80

rsa_pubkey.plain

Targets

    • Target

      dfa8eac5d28ddebc960a1035af22c2b0

    • Size

      456KB

    • MD5

      428820e4c4682fb5e10e0b414334b481

    • SHA1

      e0d56e368e1a7dbe8592366f94f89e21016b7046

    • SHA256

      bd6500d97936a3479cd8cea0dc480c8da59d4bb34a2e72c352d346a8070ebcea

    • SHA512

      5122cb94e4eb880c52e5dd61e655271fd5945e0a14c9d81d586cc34e8e91d31b9067f3e21e61ca25cb5de8cfde71db87f0b691d4ecc38862b510a73de2a7e54b

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks