General

  • Target

    d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

  • Size

    348KB

  • Sample

    210120-jthd68vaqj

  • MD5

    2a7b4fe52153defcfc316f3e903c4d24

  • SHA1

    35917e76c8a56730c75a96a1b9b5a0c973abf45c

  • SHA256

    d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

  • SHA512

    29c6d824faa32953bb23a85c47da54488711b306751e75fe63d529d52efabbe4a9e2b78a28fff46105f1464792f328ddd02efd66fbcead807b1ed19c4178548a

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

152.231.89.226:80

2.58.16.88:8080

206.189.232.2:8080

154.127.113.242:80

190.114.254.163:8080

190.210.246.253:80

138.197.99.250:8080

172.104.169.32:8080

85.214.26.7:8080

152.170.79.100:80

190.45.24.210:80

143.0.85.206:7080

46.43.2.95:8080

110.39.162.2:443

1.226.84.243:8080

87.106.46.107:8080

111.67.12.221:8080

137.74.106.111:7080

81.17.93.134:80

62.84.75.50:80

rsa_pubkey.plain

Targets

    • Target

      d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

    • Size

      348KB

    • MD5

      2a7b4fe52153defcfc316f3e903c4d24

    • SHA1

      35917e76c8a56730c75a96a1b9b5a0c973abf45c

    • SHA256

      d6f01232a80a0be3d54f58cc856a5582378b2678066000172381602c174299ad

    • SHA512

      29c6d824faa32953bb23a85c47da54488711b306751e75fe63d529d52efabbe4a9e2b78a28fff46105f1464792f328ddd02efd66fbcead807b1ed19c4178548a

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks