General

  • Target

    60eeffe5af6c7a1504899a9eeacabc832cf5b5a34c3a190cbb4d45369bdbb63c

  • Size

    190KB

  • Sample

    220708-jkmg2ahhc6

  • MD5

    9274a173ff474491e8e45700dbb7fcfd

  • SHA1

    4d7c6f50e6af7109f867a2caf84302ad4b20468d

  • SHA256

    60eeffe5af6c7a1504899a9eeacabc832cf5b5a34c3a190cbb4d45369bdbb63c

  • SHA512

    4cb3b8c3ab3b24a3eef85ce0db1ec75457459db28a1cf414efb1efcf5f227e915ca6a605fe2b65c89d941727bf81098f89b9ca07c7cb8a16c3b0bafdb2028738

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

90.160.138.175:80

74.222.117.42:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

200.116.145.225:443

142.112.10.95:20

87.106.139.101:8080

173.70.61.180:80

75.177.207.146:80

121.124.124.40:7080

98.109.133.80:80

37.187.72.193:8080

74.40.205.197:443

220.245.198.194:80

197.211.245.21:80

123.176.25.234:80

194.190.67.75:80

78.188.225.105:80

217.20.166.178:7080

rsa_pubkey.plain

Targets

    • Target

      60eeffe5af6c7a1504899a9eeacabc832cf5b5a34c3a190cbb4d45369bdbb63c

    • Size

      190KB

    • MD5

      9274a173ff474491e8e45700dbb7fcfd

    • SHA1

      4d7c6f50e6af7109f867a2caf84302ad4b20468d

    • SHA256

      60eeffe5af6c7a1504899a9eeacabc832cf5b5a34c3a190cbb4d45369bdbb63c

    • SHA512

      4cb3b8c3ab3b24a3eef85ce0db1ec75457459db28a1cf414efb1efcf5f227e915ca6a605fe2b65c89d941727bf81098f89b9ca07c7cb8a16c3b0bafdb2028738

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks