General

  • Target

    memdump2

  • Size

    96KB

  • Sample

    210128-9crqen14zn

  • MD5

    b81f1922e1db78001996daa1e9fd4d24

  • SHA1

    ca0b83ff70b16e4fb796ad7e1b5dbaa595f9cda0

  • SHA256

    a4d6cd80ddf91cb532da271518fd255ee929e2e4e7063691f04c0d15899a3ca8

  • SHA512

    286a0fcd1bcdc0e7ef891b16d4cca285966e107c321c1176cce20000944e708928ea1158b4a1bbed1459a6596cb1d349821137936581e700a26823073934a1bc

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

72.143.73.234:443

162.241.140.129:8080

104.131.123.136:443

5.196.108.189:8080

62.75.141.82:80

76.175.162.101:80

130.0.132.242:80

79.137.83.50:443

104.131.44.150:8080

109.74.5.95:8080

121.7.31.214:80

176.111.60.55:8080

172.104.97.173:8080

61.19.246.238:443

47.144.21.12:443

110.142.236.207:80

181.169.235.7:80

123.176.25.234:80

185.94.252.104:443

108.46.29.236:80

rsa_pubkey.plain

Targets

    • Target

      memdump2

    • Size

      96KB

    • MD5

      b81f1922e1db78001996daa1e9fd4d24

    • SHA1

      ca0b83ff70b16e4fb796ad7e1b5dbaa595f9cda0

    • SHA256

      a4d6cd80ddf91cb532da271518fd255ee929e2e4e7063691f04c0d15899a3ca8

    • SHA512

      286a0fcd1bcdc0e7ef891b16d4cca285966e107c321c1176cce20000944e708928ea1158b4a1bbed1459a6596cb1d349821137936581e700a26823073934a1bc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks