Resubmissions

16-09-2021 11:50

210916-nzpyxsdcc5 10

16-09-2021 11:45

210916-nw243sdcb9 10

General

  • Target

    6258788652974080.zip

  • Size

    151KB

  • Sample

    210916-nzpyxsdcc5

  • MD5

    bb520a8083cafb2745bbdc8cec248c6d

  • SHA1

    dd379438dfe3fc791de13edd24f3698019d9b670

  • SHA256

    7f78a78612fecd565ef1c3125ad1df1c9bdd210d4f97a0828c49941ad159cb68

  • SHA512

    e549f114db47c0cdc5c5254be0a5cc64f733b98a26c5b1af328599dc2a8a7982289e5e09e4c933f4fc435dbbcc0b98c4fda7401c86a53ee9062072f589232275

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

124.240.198.66:80

186.75.241.230:80

181.143.194.138:443

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

190.211.207.11:443

78.188.105.159:21

182.176.106.43:995

178.79.161.166:443

206.189.98.125:8080

87.230.19.21:8080

80.11.163.139:443

101.187.237.217:20

190.18.146.70:80

86.98.25.30:53

92.222.125.16:7080

186.4.172.5:443

rsa_pubkey.plain

Targets

    • Target

      d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790

    • Size

      474KB

    • MD5

      591d2b97f834d2c95667850564e8fbe2

    • SHA1

      cf28700496e977e7a4e01c02f20b954a01d89878

    • SHA256

      d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790

    • SHA512

      1a112bde7e667a85706d67c89663d2ec4e2dfe9bfc2a861f42d0761e633d45c93041363cffa49ed45de249e9c19373c497f8d2900288c80d36a74d14eb80e89c

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks