General

  • Target

    54f253b1d6ff9624c28ef96253e1bb6e7f4a5e6285a5282c4648e2f242bbc5b8

  • Size

    100KB

  • Sample

    220307-krf49sfbdn

  • MD5

    7134f0f2f92c6fd7008aa8fc59f69213

  • SHA1

    b3f2cf09471d3caa5fd4ab26ae7a6076ee43b947

  • SHA256

    54f253b1d6ff9624c28ef96253e1bb6e7f4a5e6285a5282c4648e2f242bbc5b8

  • SHA512

    68a79b83aeab3302af5c40a3a8ee28e532c265080f9228d9c62a4060d249e5b6f1e6099e1d7eb86b8e8ad6b86ca7879d1b29ad25aee8cab6e2188063ddad63f8

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

190.106.97.230:443

24.51.106.145:21

186.4.172.5:443

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

92.222.125.16:7080

182.176.106.43:995

31.12.67.62:7080

37.157.194.134:443

85.106.1.166:50000

201.251.43.69:8080

136.243.177.26:8080

104.131.11.150:8080

190.201.164.223:53

103.97.95.218:143

190.53.135.159:21

138.201.140.110:8080

80.11.163.139:21

rsa_pubkey.plain

Targets

    • Target

      54f253b1d6ff9624c28ef96253e1bb6e7f4a5e6285a5282c4648e2f242bbc5b8

    • Size

      100KB

    • MD5

      7134f0f2f92c6fd7008aa8fc59f69213

    • SHA1

      b3f2cf09471d3caa5fd4ab26ae7a6076ee43b947

    • SHA256

      54f253b1d6ff9624c28ef96253e1bb6e7f4a5e6285a5282c4648e2f242bbc5b8

    • SHA512

      68a79b83aeab3302af5c40a3a8ee28e532c265080f9228d9c62a4060d249e5b6f1e6099e1d7eb86b8e8ad6b86ca7879d1b29ad25aee8cab6e2188063ddad63f8

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks