General

  • Target

    4e3888c0c289fa84a59aa771e8b948e88805268273d758d279d0c76876ccb4ae

  • Size

    400KB

  • Sample

    210407-9jnht5kd9j

  • MD5

    d782643d2a7eec1f892226c6dd4a71d6

  • SHA1

    a4fa2d85f3314c10e43bc374fdb3ccd4b902feac

  • SHA256

    4e3888c0c289fa84a59aa771e8b948e88805268273d758d279d0c76876ccb4ae

  • SHA512

    36cb6ea7265401bd3ff8c7290352fa2c47f1396e494c303478e6bb534943a36a8c33469623cf01209b0b542e5738d72d8739448f6f25534a3e398a94b2e3cda6

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.186.191.177:80

91.242.138.5:80

173.13.135.102:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

80.11.163.139:21

182.176.132.213:8090

165.227.156.155:443

118.201.230.249:80

138.201.140.110:8080

46.105.131.87:80

87.106.139.101:8080

24.45.193.161:7080

209.97.168.52:8080

190.12.119.180:443

190.147.215.53:22

191.92.209.110:7080

91.205.215.66:8080

rsa_pubkey.plain

Targets

    • Target

      4e3888c0c289fa84a59aa771e8b948e88805268273d758d279d0c76876ccb4ae

    • Size

      400KB

    • MD5

      d782643d2a7eec1f892226c6dd4a71d6

    • SHA1

      a4fa2d85f3314c10e43bc374fdb3ccd4b902feac

    • SHA256

      4e3888c0c289fa84a59aa771e8b948e88805268273d758d279d0c76876ccb4ae

    • SHA512

      36cb6ea7265401bd3ff8c7290352fa2c47f1396e494c303478e6bb534943a36a8c33469623cf01209b0b542e5738d72d8739448f6f25534a3e398a94b2e3cda6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks