General

  • Target

    e5ddc0c80d69dc73f31c81b0e6e62d89febd423e2e46240e9526380af1b4372f

  • Size

    188KB

  • Sample

    210228-m6xrm1gyes

  • MD5

    d906984403b6035e3d12ff412a612040

  • SHA1

    c978301e8193e2f8ea9e9a8b39142ba23d2cd001

  • SHA256

    e5ddc0c80d69dc73f31c81b0e6e62d89febd423e2e46240e9526380af1b4372f

  • SHA512

    60ebabffdbf50979249905456a1dd5c047d8c817436ebd0162a4c86c99fa98cb6de463edda1edf594eb87c9990cfaacedd310316c0895b1eeb1b2bb1acc41f2e

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

72.143.73.234:443

162.241.140.129:8080

104.131.123.136:443

5.196.108.189:8080

62.75.141.82:80

76.175.162.101:80

130.0.132.242:80

79.137.83.50:443

104.131.44.150:8080

109.74.5.95:8080

121.7.31.214:80

176.111.60.55:8080

172.104.97.173:8080

61.19.246.238:443

47.144.21.12:443

110.142.236.207:80

181.169.235.7:80

123.176.25.234:80

185.94.252.104:443

108.46.29.236:80

rsa_pubkey.plain

Targets

    • Target

      e5ddc0c80d69dc73f31c81b0e6e62d89febd423e2e46240e9526380af1b4372f

    • Size

      188KB

    • MD5

      d906984403b6035e3d12ff412a612040

    • SHA1

      c978301e8193e2f8ea9e9a8b39142ba23d2cd001

    • SHA256

      e5ddc0c80d69dc73f31c81b0e6e62d89febd423e2e46240e9526380af1b4372f

    • SHA512

      60ebabffdbf50979249905456a1dd5c047d8c817436ebd0162a4c86c99fa98cb6de463edda1edf594eb87c9990cfaacedd310316c0895b1eeb1b2bb1acc41f2e

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks