Resubmissions

22-01-2021 10:30

210122-ebzvzq1wva 10

22-01-2021 10:26

210122-1ee91czbt6 1

22-01-2021 09:44

210122-lrtb9m92n6 10

22-01-2021 08:15

210122-992xz1jsl6 1

General

  • Target

    675242ac6a4551ef75937e33e617f536b9ff2bcfc0f208f8357ec123509859bb

  • Size

    330KB

  • Sample

    210122-lrtb9m92n6

  • MD5

    8d2f4a0fa3210f09a0b1e6d39596be02

  • SHA1

    21d3798d1a29d9f66155f36539b514545ecbe6d2

  • SHA256

    675242ac6a4551ef75937e33e617f536b9ff2bcfc0f208f8357ec123509859bb

  • SHA512

    895e331dc99dfca3be7e61863ea178c8b3d5b231c1070f982267b570c65bfdba054cbea3d4e8a61dd82d138e9bb5a75905f320fdb0a68aa6576a4710322d7cc3

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

132.248.38.158:80

203.157.152.9:7080

157.245.145.87:443

110.37.224.243:80

70.32.89.105:8080

185.142.236.163:443

192.241.220.183:8080

91.83.93.103:443

54.38.143.245:8080

192.210.217.94:8080

37.205.9.252:7080

78.90.78.210:80

182.73.7.59:8080

163.53.204.180:443

91.75.75.46:80

172.104.46.84:8080

161.49.84.2:80

27.78.27.110:443

203.160.167.243:80

109.99.146.210:8080

rsa_pubkey.plain

Targets

    • Target

      675242ac6a4551ef75937e33e617f536b9ff2bcfc0f208f8357ec123509859bb

    • Size

      330KB

    • MD5

      8d2f4a0fa3210f09a0b1e6d39596be02

    • SHA1

      21d3798d1a29d9f66155f36539b514545ecbe6d2

    • SHA256

      675242ac6a4551ef75937e33e617f536b9ff2bcfc0f208f8357ec123509859bb

    • SHA512

      895e331dc99dfca3be7e61863ea178c8b3d5b231c1070f982267b570c65bfdba054cbea3d4e8a61dd82d138e9bb5a75905f320fdb0a68aa6576a4710322d7cc3

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks