General

  • Target

    4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

  • Size

    640KB

  • Sample

    220316-lc3v6abgb7

  • MD5

    4de9c574bae78f3c6ef3bacfa6f28e56

  • SHA1

    67b05fce9591c14bfbad9dc45fa1de68d0480bbc

  • SHA256

    4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

  • SHA512

    cfba2e390b6081c781c9b8328cef650c443caa5acf32af96c9f6cf5cf034b7c6acdc3b776008cbc3b8c535301aa9cf0a286070cd496f94effbef62e064b6c05f

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

82.225.49.121:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

203.117.253.142:80

139.99.158.11:443

87.106.139.101:8080

190.160.53.126:80

5.39.91.110:7080

107.5.122.110:80

174.102.48.180:443

194.187.133.160:443

153.177.101.120:443

104.236.246.93:8080

78.24.219.147:8080

94.23.237.171:443

85.66.181.138:80

157.245.99.39:8080

201.173.217.124:443

91.211.88.52:7080

rsa_pubkey.plain

Targets

    • Target

      4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

    • Size

      640KB

    • MD5

      4de9c574bae78f3c6ef3bacfa6f28e56

    • SHA1

      67b05fce9591c14bfbad9dc45fa1de68d0480bbc

    • SHA256

      4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

    • SHA512

      cfba2e390b6081c781c9b8328cef650c443caa5acf32af96c9f6cf5cf034b7c6acdc3b776008cbc3b8c535301aa9cf0a286070cd496f94effbef62e064b6c05f

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks