General

  • Target

    Aawbbhk.exe

  • Size

    848KB

  • Sample

    201119-ac9v53ayse

  • MD5

    0a39964757fb583df74c937163d5764e

  • SHA1

    ad0df22e060d751984d7a5a8cfb529d504ef1037

  • SHA256

    def65f17686925576929402364ac724e935e8064e5d46861713d442a794f1d47

  • SHA512

    352fb4c9d1d98d8b77df5faaa31b2c68bb6ae5774a62c090e0be3dfd92e609f5b14dc65fb6ef13d986ed44fd8927e48924051a2331a6e01b6429e4e7c5eda8e7

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

45.16.226.117:443

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

45.161.242.102:80

37.52.87.0:80

137.74.106.111:7080

71.197.211.156:80

217.199.160.224:7080

186.70.127.199:8090

50.28.51.143:8080

190.115.18.139:8080

85.105.140.135:443

24.148.98.177:80

181.30.61.163:443

192.241.146.84:8080

185.94.252.27:443

77.238.212.227:80

185.94.252.12:80

190.147.137.153:443

rsa_pubkey.plain

Targets

    • Target

      Aawbbhk.exe

    • Size

      848KB

    • MD5

      0a39964757fb583df74c937163d5764e

    • SHA1

      ad0df22e060d751984d7a5a8cfb529d504ef1037

    • SHA256

      def65f17686925576929402364ac724e935e8064e5d46861713d442a794f1d47

    • SHA512

      352fb4c9d1d98d8b77df5faaa31b2c68bb6ae5774a62c090e0be3dfd92e609f5b14dc65fb6ef13d986ed44fd8927e48924051a2331a6e01b6429e4e7c5eda8e7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks