22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b

General
Target

22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b

Size

572KB

Sample

210407-h22ff8x5ae

Score
10 /10
MD5

6394ab67821651c32b6778a2a79bda66

SHA1

d9083e0f56cf231aaa22044d28829e94e464b7d2

SHA256

22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b

SHA512

dff9db981012d5e930fd24d544524be84ee4df11a36dbda5f276ca7bc95af2ce994730dad23b11905aa6be965cacd65733fb6b4ae6cdbf0a7bb69e2b31ed2540

Malware Config

Extracted

Family emotet
Botnet Epoch2
C2

212.186.191.177:80

91.242.138.5:80

173.13.135.102:80

59.110.18.236:443

45.56.88.91:443

51.68.220.244:8080

206.81.10.215:8080

80.11.163.139:21

182.176.132.213:8090

165.227.156.155:443

118.201.230.249:80

138.201.140.110:8080

46.105.131.87:80

87.106.139.101:8080

24.45.193.161:7080

209.97.168.52:8080

190.12.119.180:443

190.147.215.53:22

191.92.209.110:7080

91.205.215.66:8080

190.211.207.11:443

186.75.241.230:80

173.212.203.26:8080

67.225.179.64:8080

31.12.67.62:7080

128.65.154.183:443

189.209.217.49:80

107.2.2.28:80

167.99.105.223:7080

12.229.155.122:80

104.236.246.93:8080

178.209.71.63:8080

212.129.24.79:8080

95.128.43.213:8080

178.210.51.222:8080

5.88.182.250:80

91.231.166.126:8080

176.31.200.130:8080

192.81.213.192:8080

103.39.131.88:80

164.68.101.171:80

201.184.105.242:443

213.179.105.214:8080

149.202.153.252:8080

47.50.251.130:80

93.147.141.5:80

37.157.194.134:443

181.57.193.14:80

45.33.49.124:443

192.241.255.77:8080

rsa_pubkey.plain
Targets
Target

22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b

MD5

6394ab67821651c32b6778a2a79bda66

Filesize

572KB

Score
10/10
SHA1

d9083e0f56cf231aaa22044d28829e94e464b7d2

SHA256

22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b

SHA512

dff9db981012d5e930fd24d544524be84ee4df11a36dbda5f276ca7bc95af2ce994730dad23b11905aa6be965cacd65733fb6b4ae6cdbf0a7bb69e2b31ed2540

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Drops file in System32 directory

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        behavioral1

                        10/10

                        behavioral2

                        10/10