General

  • Target

    9f80b5d6dc1a155418079737f3f93a38c1333bda1d9fc3044d101ce4f92526e0

  • Size

    113KB

  • Sample

    220701-f3xh6sfeg5

  • MD5

    a4ec5fbd48767dcdd6f5e2fd78af6d94

  • SHA1

    160d5c0bf3bc95282f288df0d465ab8de78efc9a

  • SHA256

    9f80b5d6dc1a155418079737f3f93a38c1333bda1d9fc3044d101ce4f92526e0

  • SHA512

    70392031967be0b1a05995ec64d720e44382c270160a6c863fa9d82358d599ed98e9a1d2fa5e2d972e38e91a819490f82899cc893c2b521cd47f8ab06ec224fc

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

81.109.227.123:80

82.15.36.209:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

178.152.78.149:20

104.131.208.175:8080

136.243.177.26:8080

206.189.98.125:8080

178.79.161.166:443

195.242.117.231:8080

187.163.222.244:465

186.144.64.31:53

104.236.99.225:8080

71.244.60.230:8080

91.205.215.66:8080

212.71.234.16:8080

190.25.255.98:443

rsa_pubkey.plain

Targets

    • Target

      9f80b5d6dc1a155418079737f3f93a38c1333bda1d9fc3044d101ce4f92526e0

    • Size

      113KB

    • MD5

      a4ec5fbd48767dcdd6f5e2fd78af6d94

    • SHA1

      160d5c0bf3bc95282f288df0d465ab8de78efc9a

    • SHA256

      9f80b5d6dc1a155418079737f3f93a38c1333bda1d9fc3044d101ce4f92526e0

    • SHA512

      70392031967be0b1a05995ec64d720e44382c270160a6c863fa9d82358d599ed98e9a1d2fa5e2d972e38e91a819490f82899cc893c2b521cd47f8ab06ec224fc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks