General

  • Target

    411f6a4a7dc34eb923fa0bcf2c8341f84fb0b5b7ea1f52a01a8f0284a60a39eb

  • Size

    474KB

  • Sample

    220708-hkxgkadhaq

  • MD5

    b3455b7d775f1f9f2c06abd20d5e3168

  • SHA1

    4798e96bbdccd149b0d43f982e3cf1898595b588

  • SHA256

    411f6a4a7dc34eb923fa0bcf2c8341f84fb0b5b7ea1f52a01a8f0284a60a39eb

  • SHA512

    b58121ba1ab5f5af88c2e859df6f64dc6f7df5cab7cd72517d4324c0ea921e33905c3eebb39db0cd43ef1a929687c63993b8ffe0529daa995c0de50a44af9254

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

124.240.198.66:80

186.75.241.230:80

181.143.194.138:443

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

190.211.207.11:443

78.188.105.159:21

182.176.106.43:995

178.79.161.166:443

206.189.98.125:8080

87.230.19.21:8080

80.11.163.139:443

101.187.237.217:20

190.18.146.70:80

86.98.25.30:53

92.222.125.16:7080

186.4.172.5:443

rsa_pubkey.plain

Targets

    • Target

      411f6a4a7dc34eb923fa0bcf2c8341f84fb0b5b7ea1f52a01a8f0284a60a39eb

    • Size

      474KB

    • MD5

      b3455b7d775f1f9f2c06abd20d5e3168

    • SHA1

      4798e96bbdccd149b0d43f982e3cf1898595b588

    • SHA256

      411f6a4a7dc34eb923fa0bcf2c8341f84fb0b5b7ea1f52a01a8f0284a60a39eb

    • SHA512

      b58121ba1ab5f5af88c2e859df6f64dc6f7df5cab7cd72517d4324c0ea921e33905c3eebb39db0cd43ef1a929687c63993b8ffe0529daa995c0de50a44af9254

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks