General

  • Target

    e090ecdc6c7b118ff7d4b28676ceb0ec

  • Size

    568KB

  • Sample

    201117-s8j8jwl86e

  • MD5

    96dd0f6910c80646cd390fc7804c1be8

  • SHA1

    6c9a6bf9be087ac60fe35a0c3e7a12dac2c7dbad

  • SHA256

    b6dea66efa7692e91417d20e3f6afa4520511d4b42565da9d345297c38d5191b

  • SHA512

    3f3235821744c6af3a4fd2bd2477ae5a38a20f30ba4cacb26ae5a9ce84bdc127364bbe7d10b71bf83dbc050c8b895d944e06ced412a6f4805151433a6e106667

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

202.141.243.254:443

75.143.247.51:80

85.105.111.166:80

216.139.123.119:80

113.61.66.94:80

162.241.140.129:8080

190.12.119.180:443

2.58.16.89:8080

91.211.88.52:7080

93.147.212.206:80

71.15.245.148:8080

157.245.99.39:8080

27.114.9.93:80

50.91.114.38:80

174.106.122.139:80

47.36.140.164:80

rsa_pubkey.plain

Targets

    • Target

      e090ecdc6c7b118ff7d4b28676ceb0ec

    • Size

      568KB

    • MD5

      96dd0f6910c80646cd390fc7804c1be8

    • SHA1

      6c9a6bf9be087ac60fe35a0c3e7a12dac2c7dbad

    • SHA256

      b6dea66efa7692e91417d20e3f6afa4520511d4b42565da9d345297c38d5191b

    • SHA512

      3f3235821744c6af3a4fd2bd2477ae5a38a20f30ba4cacb26ae5a9ce84bdc127364bbe7d10b71bf83dbc050c8b895d944e06ced412a6f4805151433a6e106667

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks