General

  • Target

    f0e59f43ccf62f303b7dc3afa78ec1f1b132c09c990ba38ee630cd36a2b009b4

  • Size

    425KB

  • Sample

    220630-nf7pmaafak

  • MD5

    a64e133d9e1e574328370943e2e9b288

  • SHA1

    b0f73ec4433390b62fde1d757f4620b5d16235b6

  • SHA256

    f0e59f43ccf62f303b7dc3afa78ec1f1b132c09c990ba38ee630cd36a2b009b4

  • SHA512

    26985d7600d807e6adf82be1a64a49f969f628004dadacdaf2a668cd2b52c51061e229c8b5ed07302fdc8532b2fcc65e705a0f57ecb20db7d71cf61cb3f6e17e

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080

eck1.plain
ecs1.plain

Targets

    • Target

      f0e59f43ccf62f303b7dc3afa78ec1f1b132c09c990ba38ee630cd36a2b009b4

    • Size

      425KB

    • MD5

      a64e133d9e1e574328370943e2e9b288

    • SHA1

      b0f73ec4433390b62fde1d757f4620b5d16235b6

    • SHA256

      f0e59f43ccf62f303b7dc3afa78ec1f1b132c09c990ba38ee630cd36a2b009b4

    • SHA512

      26985d7600d807e6adf82be1a64a49f969f628004dadacdaf2a668cd2b52c51061e229c8b5ed07302fdc8532b2fcc65e705a0f57ecb20db7d71cf61cb3f6e17e

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

MITRE ATT&CK Matrix

Tasks