General

  • Target

    8dce5347fb622191974c754bebed86dd52ffa01437e9f65008a67878537b8a14

  • Size

    65KB

  • Sample

    220306-wx5kladec2

  • MD5

    b752baef8ef806d883ee635e50a6f8dd

  • SHA1

    457dd87201119c840af6f397125f16f1d0184d47

  • SHA256

    8dce5347fb622191974c754bebed86dd52ffa01437e9f65008a67878537b8a14

  • SHA512

    d2da3f7432e540886a388bd87d0f03a4de7684bc348a920ae7e5cc799d3a0e3d90b67989676287441fedc334f20d365af10d747bd5d787593588776734fe94f3

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

217.160.19.232:8080

192.241.220.155:8080

167.99.105.223:7080

176.31.200.130:8080

91.205.215.66:8080

181.143.194.138:443

167.71.10.37:8080

133.167.80.63:7080

183.102.238.69:465

190.145.67.134:8090

169.239.182.217:8080

78.24.219.147:8080

92.222.216.44:8080

47.41.213.2:22

124.240.198.66:80

189.209.217.49:80

80.11.163.139:21

190.53.135.159:21

217.160.182.191:8080

87.230.19.21:8080

rsa_pubkey.plain

Targets

    • Target

      8dce5347fb622191974c754bebed86dd52ffa01437e9f65008a67878537b8a14

    • Size

      65KB

    • MD5

      b752baef8ef806d883ee635e50a6f8dd

    • SHA1

      457dd87201119c840af6f397125f16f1d0184d47

    • SHA256

      8dce5347fb622191974c754bebed86dd52ffa01437e9f65008a67878537b8a14

    • SHA512

      d2da3f7432e540886a388bd87d0f03a4de7684bc348a920ae7e5cc799d3a0e3d90b67989676287441fedc334f20d365af10d747bd5d787593588776734fe94f3

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks