General

  • Target

    emotet_exe_e2_04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38_2020-11-17__185524.exe

  • Size

    666KB

  • Sample

    201117-paekknfges

  • MD5

    9cffa9a03f0ff4bc8b33151edfa104ed

  • SHA1

    b8838a451ff5c4eae5d552e1a8316a697955c055

  • SHA256

    04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38

  • SHA512

    6b1476ed12ef7c7605b7c3313eeb7993cd9f8fe56a985557f9ade49db0d460d01fea98ef550401ebfffc5262da56b588c8498863ca81b74e5b5895310f782e12

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

75.188.96.231:80

72.10.36.104:8080

167.114.153.111:8080

72.249.144.95:8080

80.241.255.202:8080

71.72.196.159:80

164.160.45.41:8080

203.153.216.189:7080

185.94.252.104:443

142.112.10.95:20

61.19.246.238:443

220.245.198.194:80

37.139.21.175:8080

108.46.29.236:80

209.54.13.14:80

87.106.136.232:8080

87.106.139.101:8080

176.111.60.55:8080

130.0.132.242:80

94.200.114.161:80

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e2_04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38_2020-11-17__185524.exe

    • Size

      666KB

    • MD5

      9cffa9a03f0ff4bc8b33151edfa104ed

    • SHA1

      b8838a451ff5c4eae5d552e1a8316a697955c055

    • SHA256

      04ad5c765e4e1769ed6c0c8deb6fe13370194b723ac6488e112cfe1555486a38

    • SHA512

      6b1476ed12ef7c7605b7c3313eeb7993cd9f8fe56a985557f9ade49db0d460d01fea98ef550401ebfffc5262da56b588c8498863ca81b74e5b5895310f782e12

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks