General

  • Target

    ca625d3cefbf3a471012d51c071fdefe

  • Size

    564KB

  • Sample

    201117-ja9bxlbn26

  • MD5

    e2673aa5a13fca6df74fbdc5598f67d6

  • SHA1

    efbe07c135c9e1e0ce0dfc949cc49b55520890cb

  • SHA256

    7b33350f394b24dcfc6b5a1c103fdaf4f7eb963319c85d549ebfcefb10f3aeff

  • SHA512

    163983280ffc165241650542ad4ddf06b82cf7450d2367514a031e2a699a6b840e1374f7963cabca20937ffb443cd2ba3af5d80ef041a59b2b5520c54b7fffc8

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

192.198.91.138:443

70.39.251.94:8080

87.230.25.43:8080

94.23.62.116:8080

103.13.224.53:80

101.187.81.254:80

76.121.199.225:80

178.250.54.208:8080

45.33.77.42:8080

5.196.35.138:7080

12.163.208.58:80

37.183.81.217:80

120.72.18.91:80

81.214.253.80:443

183.176.82.231:80

185.94.252.27:443

12.162.84.2:8080

74.58.215.226:80

60.249.78.226:8080

50.28.51.143:8080

rsa_pubkey.plain

Targets

    • Target

      ca625d3cefbf3a471012d51c071fdefe

    • Size

      564KB

    • MD5

      e2673aa5a13fca6df74fbdc5598f67d6

    • SHA1

      efbe07c135c9e1e0ce0dfc949cc49b55520890cb

    • SHA256

      7b33350f394b24dcfc6b5a1c103fdaf4f7eb963319c85d549ebfcefb10f3aeff

    • SHA512

      163983280ffc165241650542ad4ddf06b82cf7450d2367514a031e2a699a6b840e1374f7963cabca20937ffb443cd2ba3af5d80ef041a59b2b5520c54b7fffc8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks