General

  • Target

    c33e8c28396a2563c9cd178ac1f9e60558d4045ad35c1f99c42e0aabd7a38170

  • Size

    609KB

  • Sample

    210126-h6es6hyx3j

  • MD5

    4b9e2a91d1c1c29629e2622fbe4ee34e

  • SHA1

    eff2b4d16a62d691e142fec747af7eca9852b763

  • SHA256

    c33e8c28396a2563c9cd178ac1f9e60558d4045ad35c1f99c42e0aabd7a38170

  • SHA512

    be0ab8285ef9aefabebaa4dc57e950d073388e8887e36fb63d52e9dac3cc8e0daaff974b7a6918ec4bf1a3b192bc839f7a2538fe2b4581bb481165c9c57d94ff

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

132.248.38.158:80

110.172.180.180:8080

70.32.89.105:8080

161.49.84.2:80

37.46.129.215:8080

50.116.78.109:8080

115.79.195.246:80

178.62.254.156:8080

175.103.38.146:80

188.226.165.170:8080

91.93.3.85:8080

162.144.145.58:8080

117.2.139.117:443

190.85.46.52:7080

201.193.160.196:80

152.32.75.74:443

195.201.56.70:8080

rsa_pubkey.plain

Targets

    • Target

      c33e8c28396a2563c9cd178ac1f9e60558d4045ad35c1f99c42e0aabd7a38170

    • Size

      609KB

    • MD5

      4b9e2a91d1c1c29629e2622fbe4ee34e

    • SHA1

      eff2b4d16a62d691e142fec747af7eca9852b763

    • SHA256

      c33e8c28396a2563c9cd178ac1f9e60558d4045ad35c1f99c42e0aabd7a38170

    • SHA512

      be0ab8285ef9aefabebaa4dc57e950d073388e8887e36fb63d52e9dac3cc8e0daaff974b7a6918ec4bf1a3b192bc839f7a2538fe2b4581bb481165c9c57d94ff

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks