General

  • Target

    8088473cb357050baf08a2f17c1ca4ef.dll

  • Size

    322KB

  • Sample

    210107-hznv72znd6

  • MD5

    8088473cb357050baf08a2f17c1ca4ef

  • SHA1

    e0224d2797f107849932317c7516c6f6af32e06f

  • SHA256

    4a6a2b0f9106f473e07735edb3bb1987728fcb4522afedad28b2e88476357172

  • SHA512

    d5b582066bd3966a0ae07a58cc61a46ed750a5408e99f5f0b3d1fdcffd95ec1667674fea22b15e78332bf14e4cd30bf2985a77164bad4c6ea001e28f9e93c654

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

197.87.160.216:80

78.188.225.105:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

188.219.31.12:80

157.245.99.39:8080

172.125.40.123:80

62.30.7.67:443

120.150.60.189:80

109.74.5.95:8080

67.10.155.92:80

67.170.250.203:443

2.58.16.89:8080

186.74.215.34:80

202.141.243.254:443

118.83.154.64:443

172.86.188.251:8080

37.187.72.193:8080

87.106.139.101:8080

rsa_pubkey.plain

Targets

    • Target

      8088473cb357050baf08a2f17c1ca4ef.dll

    • Size

      322KB

    • MD5

      8088473cb357050baf08a2f17c1ca4ef

    • SHA1

      e0224d2797f107849932317c7516c6f6af32e06f

    • SHA256

      4a6a2b0f9106f473e07735edb3bb1987728fcb4522afedad28b2e88476357172

    • SHA512

      d5b582066bd3966a0ae07a58cc61a46ed750a5408e99f5f0b3d1fdcffd95ec1667674fea22b15e78332bf14e4cd30bf2985a77164bad4c6ea001e28f9e93c654

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks