General

  • Target

    95ccab76e3b269b383a39e92569c773429fe1509

  • Size

    636KB

  • Sample

    220712-ctnm5afbcl

  • MD5

    c8665b7ae2a0513c9658f39378d3c42f

  • SHA1

    95ccab76e3b269b383a39e92569c773429fe1509

  • SHA256

    e760fc0b42582d93198e24a1eb9f335eee399ed61e04255cdec3b3edded2abfc

  • SHA512

    1e66d760660e8c60af3ad6af199b7584d96e7302cce2a191e1e13e4b1311de4a775f183917ff5ad9a9ec5f60329a0ccad77449cf0c4735fe70e3ca7f6c69e9dd

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.59.253.20:21

14.160.93.230:80

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

62.75.143.100:7080

159.203.204.126:8080

151.80.142.33:80

123.168.4.66:22

46.28.111.142:7080

46.101.212.195:8080

183.82.97.25:80

190.10.194.42:8080

217.199.160.224:8080

186.1.41.111:443

185.86.148.222:8080

185.187.198.10:8080

200.57.102.71:8443

114.79.134.129:443

80.85.87.122:8080

rsa_pubkey.plain

Targets

    • Target

      95ccab76e3b269b383a39e92569c773429fe1509

    • Size

      636KB

    • MD5

      c8665b7ae2a0513c9658f39378d3c42f

    • SHA1

      95ccab76e3b269b383a39e92569c773429fe1509

    • SHA256

      e760fc0b42582d93198e24a1eb9f335eee399ed61e04255cdec3b3edded2abfc

    • SHA512

      1e66d760660e8c60af3ad6af199b7584d96e7302cce2a191e1e13e4b1311de4a775f183917ff5ad9a9ec5f60329a0ccad77449cf0c4735fe70e3ca7f6c69e9dd

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks