General

  • Target

    09c4a4a31a51590b27a82bcff450c29391d3dfde480df012f43020e858efb639

  • Size

    704KB

  • Sample

    220521-w7zr4aeddn

  • MD5

    2ff04b98e48f92a832e63c4de81a0e4e

  • SHA1

    0703e51eb1a4011398e4a571e8d91fcf6398f794

  • SHA256

    09c4a4a31a51590b27a82bcff450c29391d3dfde480df012f43020e858efb639

  • SHA512

    b4b3dd9196657bfbd1d4a0c5635bdbe870502a5f974d60543ae0880b0dca554b613de381b0dcee4114b70a3df66a61db31c5b56dfd78db0d9ef4ebe1ee72e025

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

71.197.211.156:80

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

68.183.190.199:8080

45.161.242.102:80

217.199.160.224:7080

73.116.193.136:80

190.163.31.26:80

68.183.170.114:8080

207.144.103.227:80

114.109.179.60:80

178.148.55.236:8080

188.135.15.49:80

72.47.248.48:7080

83.169.21.32:7080

24.135.198.218:80

212.174.55.22:443

174.100.27.229:80

192.241.143.52:8080

rsa_pubkey.plain

Targets

    • Target

      09c4a4a31a51590b27a82bcff450c29391d3dfde480df012f43020e858efb639

    • Size

      704KB

    • MD5

      2ff04b98e48f92a832e63c4de81a0e4e

    • SHA1

      0703e51eb1a4011398e4a571e8d91fcf6398f794

    • SHA256

      09c4a4a31a51590b27a82bcff450c29391d3dfde480df012f43020e858efb639

    • SHA512

      b4b3dd9196657bfbd1d4a0c5635bdbe870502a5f974d60543ae0880b0dca554b613de381b0dcee4114b70a3df66a61db31c5b56dfd78db0d9ef4ebe1ee72e025

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks