bad71.bin

General
Target

bad71.bin

Size

752KB

Sample

211119-yjrspabdeq

Score
10 /10
MD5

b356ddc2348a102711ccd47a65b6cbcf

SHA1

9d72d0985e61dc81758e0afcb58375e6182e7d66

SHA256

5a89c0b4d52a8feb9b4bf7ebd49eb7a84b54b9cd94ced300b16202177926287f

SHA512

3eb612bdd8f01c3b182a980fe79d47980d16fd9d934e13bd5f2db06163b60e63e8054add2dcffedb0cb8a8e2d66d67838ab7cbf58c6125d35ea3f32edec73fc2

Malware Config

Extracted

Family emotet
Botnet Epoch2
C2

217.160.19.232:8080

192.241.220.155:8080

167.99.105.223:7080

176.31.200.130:8080

91.205.215.66:8080

181.143.194.138:443

167.71.10.37:8080

133.167.80.63:7080

183.102.238.69:465

190.145.67.134:8090

169.239.182.217:8080

78.24.219.147:8080

92.222.216.44:8080

47.41.213.2:22

124.240.198.66:80

189.209.217.49:80

80.11.163.139:21

190.53.135.159:21

217.160.182.191:8080

87.230.19.21:8080

136.243.177.26:8080

178.79.161.166:443

144.139.247.220:80

103.39.131.88:80

192.81.213.192:8080

152.89.236.214:8080

62.75.187.192:8080

46.105.131.87:80

190.226.44.20:21

173.212.203.26:8080

181.31.213.158:8080

190.228.72.244:53

104.131.44.150:8080

95.128.43.213:8080

104.131.11.150:8080

186.4.172.5:20

94.205.247.10:80

200.71.148.138:8080

5.196.74.210:8080

37.157.194.134:443

200.51.94.251:80

171.101.153.86:990

45.33.49.124:443

181.143.53.227:21

86.22.221.170:80

87.106.139.101:8080

83.136.245.190:8080

94.177.216.217:8080

31.12.67.62:7080

138.201.140.110:8080

rsa_pubkey.plain
Targets
Target

bad71.bin

MD5

b356ddc2348a102711ccd47a65b6cbcf

Filesize

752KB

Score
10/10
SHA1

9d72d0985e61dc81758e0afcb58375e6182e7d66

SHA256

5a89c0b4d52a8feb9b4bf7ebd49eb7a84b54b9cd94ced300b16202177926287f

SHA512

3eb612bdd8f01c3b182a980fe79d47980d16fd9d934e13bd5f2db06163b60e63e8054add2dcffedb0cb8a8e2d66d67838ab7cbf58c6125d35ea3f32edec73fc2

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Drops file in System32 directory

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        behavioral1

                        10/10

                        behavioral2

                        10/10