d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

General
Target

d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

Size

348KB

Sample

210120-jthd68vaqj

Score
10 /10
MD5

2a7b4fe52153defcfc316f3e903c4d24

SHA1

35917e76c8a56730c75a96a1b9b5a0c973abf45c

SHA256

d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

SHA512

29c6d824faa32953bb23a85c47da54488711b306751e75fe63d529d52efabbe4a9e2b78a28fff46105f1464792f328ddd02efd66fbcead807b1ed19c4178548a

Malware Config

Extracted

Family emotet
Botnet Epoch1
C2

152.231.89.226:80

2.58.16.88:8080

206.189.232.2:8080

154.127.113.242:80

190.114.254.163:8080

190.210.246.253:80

138.197.99.250:8080

172.104.169.32:8080

85.214.26.7:8080

152.170.79.100:80

190.45.24.210:80

143.0.85.206:7080

46.43.2.95:8080

110.39.162.2:443

1.226.84.243:8080

87.106.46.107:8080

111.67.12.221:8080

137.74.106.111:7080

81.17.93.134:80

62.84.75.50:80

51.255.165.160:8080

177.23.7.151:80

51.15.7.145:80

178.211.45.66:8080

170.81.48.2:80

178.250.54.208:8080

200.75.39.254:80

191.223.36.170:80

186.177.174.163:80

202.134.4.210:7080

138.97.60.140:8080

190.247.139.101:80

185.94.252.27:443

152.169.22.67:80

190.24.243.186:80

190.251.216.100:80

80.15.100.37:80

192.232.229.53:4143

5.196.35.138:7080

78.206.229.130:80

191.241.233.198:80

110.39.160.38:443

46.105.114.137:8080

93.146.143.191:80

172.245.248.239:8080

81.215.230.173:443

190.162.232.138:80

82.208.146.142:7080

31.27.59.105:80

190.64.88.186:443

rsa_pubkey.plain
Targets
Target

d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

MD5

2a7b4fe52153defcfc316f3e903c4d24

Filesize

348KB

Score
10 /10
SHA1

35917e76c8a56730c75a96a1b9b5a0c973abf45c

SHA256

d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

SHA512

29c6d824faa32953bb23a85c47da54488711b306751e75fe63d529d52efabbe4a9e2b78a28fff46105f1464792f328ddd02efd66fbcead807b1ed19c4178548a

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Blocklisted process makes network request

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10