General

  • Target

    3b9bb674c9d2fad913cedd560bc7f3307041086d601c3a20897e51f915cdc610

  • Size

    254KB

  • Sample

    220703-l9xemsehcm

  • MD5

    eee3d28e9ca19d5cb75ae00e497e9c16

  • SHA1

    35a45bf1cc9d5b4648b46a60ca6dca8b95d8eb63

  • SHA256

    3b9bb674c9d2fad913cedd560bc7f3307041086d601c3a20897e51f915cdc610

  • SHA512

    b1c052174297dea7614bfe58af3477726f6e36e33f7bbd4746b00938068a51f49e250c9b4e8e6ca7c5e1bb99a6dd11f780abfdec8ab9b8f8f29cbbf3ffd5461a

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.205.247.10:80

86.22.221.170:80

85.25.255.207:8080

185.94.252.13:443

94.177.216.217:8080

62.75.187.192:8080

78.24.219.147:8080

91.205.215.66:8080

24.45.195.162:7080

94.192.225.46:80

200.113.106.18:21

186.4.172.5:8080

104.131.44.150:8080

67.225.229.55:8080

190.226.44.20:21

92.233.128.13:143

5.196.74.210:8080

185.187.198.15:80

87.230.19.21:8080

186.176.138.171:7080

rsa_pubkey.plain

Targets

    • Target

      3b9bb674c9d2fad913cedd560bc7f3307041086d601c3a20897e51f915cdc610

    • Size

      254KB

    • MD5

      eee3d28e9ca19d5cb75ae00e497e9c16

    • SHA1

      35a45bf1cc9d5b4648b46a60ca6dca8b95d8eb63

    • SHA256

      3b9bb674c9d2fad913cedd560bc7f3307041086d601c3a20897e51f915cdc610

    • SHA512

      b1c052174297dea7614bfe58af3477726f6e36e33f7bbd4746b00938068a51f49e250c9b4e8e6ca7c5e1bb99a6dd11f780abfdec8ab9b8f8f29cbbf3ffd5461a

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks