General

  • Target

    b1e18fe75f95f241101372eab80e5404

  • Size

    667KB

  • Sample

    201117-y91tybwmfn

  • MD5

    f2dbb544d86ce16f113ed96dab51b166

  • SHA1

    c315a30b2789bc57dd40846b477c124d468d0e5d

  • SHA256

    51c11d947ee5cbab4758b262b81905c516d3a6c501eec789ee9609e87970fde3

  • SHA512

    c25bb987af066aec6c15ab8bd99713326cbce768be75093d2bda5dd54b80c6d19ade940c334c6c567e9ef5d20956cfe94db2d534f009bf8c9755ca9fd1e0ffe2

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain

Targets

    • Target

      b1e18fe75f95f241101372eab80e5404

    • Size

      667KB

    • MD5

      f2dbb544d86ce16f113ed96dab51b166

    • SHA1

      c315a30b2789bc57dd40846b477c124d468d0e5d

    • SHA256

      51c11d947ee5cbab4758b262b81905c516d3a6c501eec789ee9609e87970fde3

    • SHA512

      c25bb987af066aec6c15ab8bd99713326cbce768be75093d2bda5dd54b80c6d19ade940c334c6c567e9ef5d20956cfe94db2d534f009bf8c9755ca9fd1e0ffe2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks