General

  • Target

    8b1f26b836e0e5b5f774dab79d2a8cbdf2fb5b6e79033c3394aa9bdbcc7e10ce

  • Size

    187KB

  • Sample

    220708-sfrevshce4

  • MD5

    1ad9038353440e357f19f69116d94032

  • SHA1

    398fff8e07038b7d5ac1f1a0e5db5d923e64d7e1

  • SHA256

    8b1f26b836e0e5b5f774dab79d2a8cbdf2fb5b6e79033c3394aa9bdbcc7e10ce

  • SHA512

    46c67f121cb66888dc99124489c380d4535b803b1e559f173fe6e8d9e0ad93787da5c0df56dca2ad606a10d2545cb116ee23c1beb4608d20f19a30e458c75355

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

5.2.136.90:80

186.147.237.3:8080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

187.162.248.237:80

1.226.84.243:8080

110.39.160.38:443

5.196.35.138:7080

59.148.253.194:8080

45.16.226.117:443

95.76.153.115:80

181.61.182.143:80

46.43.2.95:8080

188.135.15.49:80

81.215.230.173:443

45.4.32.50:80

81.214.253.80:443

94.176.234.118:443

212.71.237.140:8080

rsa_pubkey.plain

Targets

    • Target

      8b1f26b836e0e5b5f774dab79d2a8cbdf2fb5b6e79033c3394aa9bdbcc7e10ce

    • Size

      187KB

    • MD5

      1ad9038353440e357f19f69116d94032

    • SHA1

      398fff8e07038b7d5ac1f1a0e5db5d923e64d7e1

    • SHA256

      8b1f26b836e0e5b5f774dab79d2a8cbdf2fb5b6e79033c3394aa9bdbcc7e10ce

    • SHA512

      46c67f121cb66888dc99124489c380d4535b803b1e559f173fe6e8d9e0ad93787da5c0df56dca2ad606a10d2545cb116ee23c1beb4608d20f19a30e458c75355

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks