General

  • Target

    4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010

  • Size

    417KB

  • Sample

    210228-gv331c4a9e

  • MD5

    e06d94ac992fd166a7252ed7e19a9b35

  • SHA1

    ce889528ed2e502d0d4be83723dd49c9e8ab3d5a

  • SHA256

    4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010

  • SHA512

    4e7441edb25ce034adad09661755c580985f79876c6838e2432e368f6bed293193e9f39fa24dfbd91ce0dfc484e0a9d2079b9f35c3130e148d24bfff5e47f426

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

177.85.167.10:80

186.188.212.201:80

94.23.62.116:8080

98.103.204.12:443

59.148.253.194:8080

216.47.196.104:80

94.176.234.118:443

137.74.106.111:7080

181.61.182.143:80

177.107.79.214:8080

85.214.26.7:8080

51.75.33.127:80

190.190.219.184:80

70.32.84.74:8080

81.214.253.80:443

77.238.212.227:80

78.206.229.130:80

103.236.179.162:80

213.197.182.158:8080

101.187.81.254:80

rsa_pubkey.plain

Targets

    • Target

      4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010

    • Size

      417KB

    • MD5

      e06d94ac992fd166a7252ed7e19a9b35

    • SHA1

      ce889528ed2e502d0d4be83723dd49c9e8ab3d5a

    • SHA256

      4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010

    • SHA512

      4e7441edb25ce034adad09661755c580985f79876c6838e2432e368f6bed293193e9f39fa24dfbd91ce0dfc484e0a9d2079b9f35c3130e148d24bfff5e47f426

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks