General

  • Target

    jwjlknck

  • Size

    664KB

  • Sample

    220626-gdywdahbbl

  • MD5

    945958b58306617cde346d9ed4f8c33c

  • SHA1

    cd25656822e24856692e3ab9c54ccfe18a334f7d

  • SHA256

    ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf

  • SHA512

    9e0c8e9cac1a808849de37d1fc6ca2d82a941eeaeb2772bea61a15429c889e1f798b53e30cf5911fbe846ee73345c79f8a104f2f84211a011883c069f7cec73a

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

149.56.128.192:443

120.50.40.183:80

160.16.218.63:8080

217.182.25.250:8080

119.193.124.41:7080

103.75.201.2:443

195.201.151.129:8080

131.100.24.231:80

159.65.88.10:8080

1.234.21.73:7080

5.9.116.246:8080

103.75.201.4:443

176.104.106.96:8080

138.185.72.26:8080

212.237.17.99:8080

72.15.201.15:8080

103.43.46.182:443

207.38.84.195:8080

46.55.222.11:443

1.234.2.232:8080

eck1.plain
ecs1.plain

Targets

    • Target

      jwjlknck

    • Size

      664KB

    • MD5

      945958b58306617cde346d9ed4f8c33c

    • SHA1

      cd25656822e24856692e3ab9c54ccfe18a334f7d

    • SHA256

      ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf

    • SHA512

      9e0c8e9cac1a808849de37d1fc6ca2d82a941eeaeb2772bea61a15429c889e1f798b53e30cf5911fbe846ee73345c79f8a104f2f84211a011883c069f7cec73a

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

MITRE ATT&CK Matrix

Tasks