emotet_exe_e1_4b91092e60ce4a32502fcb9489722108d033beac779e5f229743a666c05d3041_2020-11-19__145146._exe

General
Target

emotet_exe_e1_4b91092e60ce4a32502fcb9489722108d033beac779e5f229743a666c05d3041_2020-11-19__145146._exe

Size

432KB

Sample

201119-x55kh54nfs

Score
10 /10
MD5

99741f11d5f67e1305b317cb51ae315f

SHA1

df40f59684f1b440e6c955c5a59ae159e421c4f7

SHA256

ff63368c331815393e5743a7ddc828adcba51a3dbfca0b51e81c66bc615d3d5c

SHA512

e4918668400b66ca90d2374d48ec8f1cdd802861595479f4f578adaf8433889016123dcc5d1bfc8ec6cd8bced44c1c050eae570b6b3d4005cd9bbcf7f5408252

Malware Config

Extracted

Family emotet
Botnet Epoch1
C2

181.30.61.163:443

209.126.6.222:8080

5.153.250.14:8080

188.135.15.49:80

104.131.41.185:8080

178.250.54.208:8080

50.28.51.143:8080

170.81.48.2:80

87.106.46.107:8080

191.99.160.58:80

187.162.248.237:80

89.32.150.160:8080

46.28.111.142:7080

190.190.148.27:8080

190.115.18.139:8080

178.79.163.131:8080

73.213.208.163:80

219.92.8.17:8080

95.9.180.128:80

212.71.237.140:8080

82.196.15.205:8080

111.67.12.221:8080

24.135.198.218:80

202.4.57.96:80

61.92.159.208:8080

80.249.176.206:80

77.90.136.129:8080

81.129.198.57:80

58.171.153.81:80

217.13.106.14:8080

24.148.98.177:80

51.255.165.160:8080

190.6.193.152:8080

149.62.173.247:8080

94.206.45.18:80

137.74.106.111:7080

190.195.129.227:8090

85.109.159.61:443

207.144.103.227:80

91.219.169.180:80

217.199.160.224:7080

104.131.103.37:8080

83.169.21.32:7080

82.163.245.38:80

204.225.249.100:7080

152.169.22.67:80

45.161.242.102:80

65.36.62.20:80

185.94.252.27:443

116.125.120.88:443

rsa_pubkey.plain
Targets
Target

emotet_exe_e1_4b91092e60ce4a32502fcb9489722108d033beac779e5f229743a666c05d3041_2020-11-19__145146._exe

MD5

99741f11d5f67e1305b317cb51ae315f

Filesize

432KB

Score
10 /10
SHA1

df40f59684f1b440e6c955c5a59ae159e421c4f7

SHA256

ff63368c331815393e5743a7ddc828adcba51a3dbfca0b51e81c66bc615d3d5c

SHA512

e4918668400b66ca90d2374d48ec8f1cdd802861595479f4f578adaf8433889016123dcc5d1bfc8ec6cd8bced44c1c050eae570b6b3d4005cd9bbcf7f5408252

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10