4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

General
Target

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

Size

432KB

Sample

220521-xxzj1sfhhp

Score
10 /10
MD5

596927e25ae8e3d16be6523372ccda76

SHA1

609996bfb036d2a6ec9b434f96333bd877df8277

SHA256

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

SHA512

ebfee2a7b9dcb39a2ae9762b7fc7a710aab9d154150d1fe21a81430f6730249c1b855365e260f6359693cba9ecfec45bf4717bac4467cea7a80412707a36b7b1

Malware Config

Extracted

Family emotet
Botnet Epoch1
C2

181.30.61.163:443

209.126.6.222:8080

5.153.250.14:8080

188.135.15.49:80

104.131.41.185:8080

178.250.54.208:8080

50.28.51.143:8080

170.81.48.2:80

87.106.46.107:8080

191.99.160.58:80

187.162.248.237:80

89.32.150.160:8080

46.28.111.142:7080

190.190.148.27:8080

190.115.18.139:8080

178.79.163.131:8080

73.213.208.163:80

219.92.8.17:8080

95.9.180.128:80

212.71.237.140:8080

82.196.15.205:8080

111.67.12.221:8080

24.135.198.218:80

202.4.57.96:80

61.92.159.208:8080

80.249.176.206:80

77.90.136.129:8080

81.129.198.57:80

58.171.153.81:80

217.13.106.14:8080

24.148.98.177:80

51.255.165.160:8080

190.6.193.152:8080

149.62.173.247:8080

94.206.45.18:80

137.74.106.111:7080

190.195.129.227:8090

85.109.159.61:443

207.144.103.227:80

91.219.169.180:80

217.199.160.224:7080

104.131.103.37:8080

83.169.21.32:7080

82.163.245.38:80

204.225.249.100:7080

152.169.22.67:80

45.161.242.102:80

65.36.62.20:80

185.94.252.27:443

116.125.120.88:443

rsa_pubkey.plain
Targets
Target

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

MD5

596927e25ae8e3d16be6523372ccda76

Filesize

432KB

Score
10/10
SHA1

609996bfb036d2a6ec9b434f96333bd877df8277

SHA256

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

SHA512

ebfee2a7b9dcb39a2ae9762b7fc7a710aab9d154150d1fe21a81430f6730249c1b855365e260f6359693cba9ecfec45bf4717bac4467cea7a80412707a36b7b1

Tags

Signatures

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

    Description

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

    Tags

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

    Description

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

    Tags

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1