General

  • Target

    emotet_epoch4.dll

  • Size

    1016KB

  • Sample

    220315-136r3agce6

  • MD5

    44360ac910a34cc7f68659385e90a692

  • SHA1

    940dc0179de83b614bf23ff27b1fba24a702f137

  • SHA256

    21f94d0e611799fbcb7c633a3e902d85d5939ddb7ea05bc26d9f15e271eef4e2

  • SHA512

    c7c6d5856588f099c3b5c4e25d0c3297250eb46478b252883aa0a719e59f165e950ed5ab8268b183aed572954a5e072e44240149cf06cb0ec2a806571c9dc3c6

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.76.1.145:443

217.182.25.250:8080

119.193.124.41:7080

192.99.251.50:443

146.59.226.45:443

173.212.193.249:8080

207.38.84.195:8080

45.118.135.203:7080

31.24.158.56:8080

209.126.98.206:8080

212.237.17.99:8080

216.158.226.206:443

50.30.40.196:8080

82.165.152.127:8080

159.8.59.82:8080

107.182.225.142:8080

110.232.117.186:8080

72.15.201.15:8080

5.9.116.246:8080

79.172.212.216:8080

eck1.plain
ecs1.plain

Targets

    • Target

      emotet_epoch4.dll

    • Size

      1016KB

    • MD5

      44360ac910a34cc7f68659385e90a692

    • SHA1

      940dc0179de83b614bf23ff27b1fba24a702f137

    • SHA256

      21f94d0e611799fbcb7c633a3e902d85d5939ddb7ea05bc26d9f15e271eef4e2

    • SHA512

      c7c6d5856588f099c3b5c4e25d0c3297250eb46478b252883aa0a719e59f165e950ed5ab8268b183aed572954a5e072e44240149cf06cb0ec2a806571c9dc3c6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks