General

  • Target

    bad71.bin

  • Size

    752KB

  • Sample

    211119-yjrspabdeq

  • MD5

    b356ddc2348a102711ccd47a65b6cbcf

  • SHA1

    9d72d0985e61dc81758e0afcb58375e6182e7d66

  • SHA256

    5a89c0b4d52a8feb9b4bf7ebd49eb7a84b54b9cd94ced300b16202177926287f

  • SHA512

    3eb612bdd8f01c3b182a980fe79d47980d16fd9d934e13bd5f2db06163b60e63e8054add2dcffedb0cb8a8e2d66d67838ab7cbf58c6125d35ea3f32edec73fc2

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

217.160.19.232:8080

192.241.220.155:8080

167.99.105.223:7080

176.31.200.130:8080

91.205.215.66:8080

181.143.194.138:443

167.71.10.37:8080

133.167.80.63:7080

183.102.238.69:465

190.145.67.134:8090

169.239.182.217:8080

78.24.219.147:8080

92.222.216.44:8080

47.41.213.2:22

124.240.198.66:80

189.209.217.49:80

80.11.163.139:21

190.53.135.159:21

217.160.182.191:8080

87.230.19.21:8080

rsa_pubkey.plain

Targets

    • Target

      bad71.bin

    • Size

      752KB

    • MD5

      b356ddc2348a102711ccd47a65b6cbcf

    • SHA1

      9d72d0985e61dc81758e0afcb58375e6182e7d66

    • SHA256

      5a89c0b4d52a8feb9b4bf7ebd49eb7a84b54b9cd94ced300b16202177926287f

    • SHA512

      3eb612bdd8f01c3b182a980fe79d47980d16fd9d934e13bd5f2db06163b60e63e8054add2dcffedb0cb8a8e2d66d67838ab7cbf58c6125d35ea3f32edec73fc2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks