967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

General
Target

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

Size

584KB

Sample

210913-ktqrgsddb9

Score
10 /10
MD5

430b59363f1aaebb0682c525d60e7bf6

SHA1

75afa9329b922fc49430c34ef37514f2f9e5802b

SHA256

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

SHA512

20587cfa212f8d9554fc97ba336c27438e75d0525baa1ffacfc594bbfa570fe02077d4ab8097496933cc93ca2653404301220ec642d0505360ff8f8ec32ec1ac

Malware Config

Extracted

Family emotet
Botnet Epoch2
C2

94.49.254.194:80

212.51.142.238:8080

91.231.166.124:8080

162.241.92.219:8080

79.98.24.39:8080

109.117.53.230:443

78.189.165.52:8080

113.160.130.116:8443

121.124.124.40:7080

101.187.97.173:80

168.235.67.138:7080

104.131.44.150:8080

5.39.91.110:7080

139.59.60.244:8080

81.2.235.111:8080

116.203.32.252:8080

61.19.246.238:443

176.111.60.55:8080

190.55.181.54:443

108.48.41.69:80

203.153.216.189:7080

103.86.49.11:8080

104.236.246.93:8080

75.139.38.211:80

169.239.182.217:8080

62.75.141.82:80

93.156.165.186:80

73.11.153.178:8080

157.245.99.39:8080

41.60.200.34:80

50.116.86.205:8080

31.31.77.83:443

209.182.216.177:443

62.138.26.28:8080

95.213.236.64:8080

95.179.229.244:8080

209.141.54.221:8080

91.211.88.52:7080

173.91.22.41:80

222.214.218.37:4143

37.187.72.193:8080

137.59.187.107:8080

139.130.242.43:80

46.105.131.87:80

87.106.139.101:8080

200.55.243.138:8080

5.196.74.210:8080

79.7.158.208:80

185.94.252.104:443

104.131.11.150:443

rsa_pubkey.plain
Targets
Target

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

MD5

430b59363f1aaebb0682c525d60e7bf6

Filesize

584KB

Score
10/10
SHA1

75afa9329b922fc49430c34ef37514f2f9e5802b

SHA256

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

SHA512

20587cfa212f8d9554fc97ba336c27438e75d0525baa1ffacfc594bbfa570fe02077d4ab8097496933cc93ca2653404301220ec642d0505360ff8f8ec32ec1ac

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10