General

  • Target

    ae792310615316f64962e9afb1a6d0ca

  • Size

    764KB

  • Sample

    201117-vfgxrm28mj

  • MD5

    46ac52ac78cb1d5c2389b2065e7c683c

  • SHA1

    fbe57c4cf1acbc9d3ee1f91d6226d19a67147a7b

  • SHA256

    eb6b078ffa47ced53fe8059f178c6e766366ae2815fef5fba94e39d34be63b85

  • SHA512

    ee940e61e1cb31630d71de1f432144a044a4d3d0d26b33b388f44e3fb24f4efc2d24e348e6cfc991ab55a379b035b266b3c0a7c4528747a5b9ec72fff9e386f7

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

154.91.33.137:443

49.12.113.171:8080

167.114.153.111:8080

87.106.136.232:8080

110.145.77.103:80

74.214.230.200:80

186.74.215.34:80

37.179.204.33:80

172.86.188.251:8080

75.188.96.231:80

118.83.154.64:443

209.54.13.14:80

176.113.52.6:443

97.82.79.83:80

112.185.64.233:80

119.59.116.21:8080

62.171.142.179:8080

62.75.141.82:80

139.99.158.11:443

50.91.114.38:80

rsa_pubkey.plain

Targets

    • Target

      ae792310615316f64962e9afb1a6d0ca

    • Size

      764KB

    • MD5

      46ac52ac78cb1d5c2389b2065e7c683c

    • SHA1

      fbe57c4cf1acbc9d3ee1f91d6226d19a67147a7b

    • SHA256

      eb6b078ffa47ced53fe8059f178c6e766366ae2815fef5fba94e39d34be63b85

    • SHA512

      ee940e61e1cb31630d71de1f432144a044a4d3d0d26b33b388f44e3fb24f4efc2d24e348e6cfc991ab55a379b035b266b3c0a7c4528747a5b9ec72fff9e386f7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks