General

  • Target

    emotet_exe_e2_440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6_2020-11-17__174954._exe

  • Size

    568KB

  • Sample

    201117-kh2yvdmp6j

  • MD5

    584047ef86f9101e9fcdd8ce3c903e8e

  • SHA1

    61b963216c5e0a2c06d7c2ced62d53d3abb4aa5d

  • SHA256

    440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6

  • SHA512

    37ecc5255eb0ce02521f0a2a489e115382d963c3c415bb8c2fe8997b7c73e6e8361f8282bf06fe275761b0703da5b9f4f805b800c2d5cb5ad2e9462634bc4cf1

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

202.141.243.254:443

75.143.247.51:80

85.105.111.166:80

216.139.123.119:80

113.61.66.94:80

162.241.140.129:8080

190.12.119.180:443

2.58.16.89:8080

91.211.88.52:7080

93.147.212.206:80

71.15.245.148:8080

157.245.99.39:8080

27.114.9.93:80

50.91.114.38:80

174.106.122.139:80

47.36.140.164:80

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e2_440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6_2020-11-17__174954._exe

    • Size

      568KB

    • MD5

      584047ef86f9101e9fcdd8ce3c903e8e

    • SHA1

      61b963216c5e0a2c06d7c2ced62d53d3abb4aa5d

    • SHA256

      440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6

    • SHA512

      37ecc5255eb0ce02521f0a2a489e115382d963c3c415bb8c2fe8997b7c73e6e8361f8282bf06fe275761b0703da5b9f4f805b800c2d5cb5ad2e9462634bc4cf1

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks