General

  • Target

    f5b38911ae75c82cc22874fd3db0def9ceffed76fe6e464057f0fdf0a70bac67

  • Size

    609KB

  • Sample

    210126-dr7rkgqaqx

  • MD5

    1909e034ee212f7dac00cc687f81f6be

  • SHA1

    5828e71b66a520e6b4624a4b4aaa352bd73fa6c7

  • SHA256

    f5b38911ae75c82cc22874fd3db0def9ceffed76fe6e464057f0fdf0a70bac67

  • SHA512

    901a9384204158fb06715603f238a010e29c4954e6079aba40cc3c9b8b54f301ad782ae5a6cd840153416c6cee4f0fb9efec12d77903607f6431a9fe0933a2dc

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

132.248.38.158:80

110.172.180.180:8080

70.32.89.105:8080

161.49.84.2:80

37.46.129.215:8080

50.116.78.109:8080

115.79.195.246:80

178.62.254.156:8080

175.103.38.146:80

188.226.165.170:8080

91.93.3.85:8080

162.144.145.58:8080

117.2.139.117:443

190.85.46.52:7080

201.193.160.196:80

152.32.75.74:443

195.201.56.70:8080

rsa_pubkey.plain

Targets

    • Target

      f5b38911ae75c82cc22874fd3db0def9ceffed76fe6e464057f0fdf0a70bac67

    • Size

      609KB

    • MD5

      1909e034ee212f7dac00cc687f81f6be

    • SHA1

      5828e71b66a520e6b4624a4b4aaa352bd73fa6c7

    • SHA256

      f5b38911ae75c82cc22874fd3db0def9ceffed76fe6e464057f0fdf0a70bac67

    • SHA512

      901a9384204158fb06715603f238a010e29c4954e6079aba40cc3c9b8b54f301ad782ae5a6cd840153416c6cee4f0fb9efec12d77903607f6431a9fe0933a2dc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks