General

  • Target

    6656c03feb766be552d8812f8c12b04f58432af3549326fb30f905af5a81485f

  • Size

    460KB

  • Sample

    220301-e85ajagad2

  • MD5

    d706333465492269d3d699302ef945ad

  • SHA1

    a464ef4905c55aad734986698fbd5f59dd6b5a23

  • SHA256

    6656c03feb766be552d8812f8c12b04f58432af3549326fb30f905af5a81485f

  • SHA512

    6c5a519606fa6d54c0035728c3321089e169c5dfc37e128ced51d29c3047f4a142d1a8820525e2582a5da1c367827e77e3b52f09fec544ae9c75676238c1969a

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

67.170.250.203:443

121.124.124.40:7080

103.86.49.11:8080

74.214.230.200:80

194.187.133.160:443

172.104.97.173:8080

172.91.208.86:80

200.116.145.225:443

202.134.4.216:8080

172.105.13.66:443

190.164.104.62:80

50.35.17.13:80

176.111.60.55:8080

201.241.127.190:80

66.76.12.94:8080

95.213.236.64:8080

rsa_pubkey.plain

Targets

    • Target

      6656c03feb766be552d8812f8c12b04f58432af3549326fb30f905af5a81485f

    • Size

      460KB

    • MD5

      d706333465492269d3d699302ef945ad

    • SHA1

      a464ef4905c55aad734986698fbd5f59dd6b5a23

    • SHA256

      6656c03feb766be552d8812f8c12b04f58432af3549326fb30f905af5a81485f

    • SHA512

      6c5a519606fa6d54c0035728c3321089e169c5dfc37e128ced51d29c3047f4a142d1a8820525e2582a5da1c367827e77e3b52f09fec544ae9c75676238c1969a

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks