Resubmissions

22-01-2021 10:26

210122-6nl94j5x3s 10

22-01-2021 09:46

210122-xpqz65af46 10

22-01-2021 09:41

210122-rtmlhw9g92 10

22-01-2021 08:16

210122-bc9mjrf156 1

General

  • Target

    4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215

  • Size

    346KB

  • Sample

    210122-xpqz65af46

  • MD5

    08667fc58fec60e818c3344ed718a1dd

  • SHA1

    d7419be7b98d03cb1b8976d197404a253eef5fe4

  • SHA256

    4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215

  • SHA512

    90d433aa772b3b974360cd5e52c8014fd2c73a0f4330d2386fcf5b3c501050d56e4d4fa897411f16d0ed7f92e9c94d2f152ea2baf18ed357d7b28f8080b857ac

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.10.46.92:80

2.58.16.88:8080

206.189.232.2:8080

178.250.54.208:8080

167.71.148.58:443

202.134.4.210:7080

187.162.248.237:80

78.206.229.130:80

85.214.26.7:8080

5.196.35.138:7080

1.226.84.243:8080

110.39.162.2:443

185.183.16.47:80

152.231.89.226:80

138.97.60.141:7080

94.176.234.118:443

46.101.58.37:8080

93.146.143.191:80

70.32.84.74:8080

137.74.106.111:7080

rsa_pubkey.plain

Targets

    • Target

      4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215

    • Size

      346KB

    • MD5

      08667fc58fec60e818c3344ed718a1dd

    • SHA1

      d7419be7b98d03cb1b8976d197404a253eef5fe4

    • SHA256

      4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215

    • SHA512

      90d433aa772b3b974360cd5e52c8014fd2c73a0f4330d2386fcf5b3c501050d56e4d4fa897411f16d0ed7f92e9c94d2f152ea2baf18ed357d7b28f8080b857ac

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks