General

  • Target

    e978390c067b287c06aafef6078db2dbcd853ff05e8e03ad0b292dfc60a984af

  • Size

    369KB

  • Sample

    220724-1vvptsabek

  • MD5

    be1ee83eb1d54fce86f2e19a2a41b5f5

  • SHA1

    b450862528ad0d2203c81859e8a6f575a068be99

  • SHA256

    e978390c067b287c06aafef6078db2dbcd853ff05e8e03ad0b292dfc60a984af

  • SHA512

    3b4361188d5d15e495d7c0ed695c3244b0abdc4e960751b3f500dd7145e50f9b79aa5ecac6fcb0df1f246f613b61d9b8b2e461992154882a3a460def33229ddb

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.90.29.228:443

181.135.153.203:443

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

46.28.111.142:7080

186.0.95.172:80

46.41.151.103:8080

190.230.60.129:80

181.188.149.134:80

88.250.223.190:8080

183.82.97.25:80

212.71.237.140:8080

200.57.102.71:8443

189.166.68.89:443

170.84.133.72:7080

81.169.140.14:443

149.62.173.247:8080

94.183.71.206:7080

142.93.82.57:8080

rsa_pubkey.plain

Targets

    • Target

      e978390c067b287c06aafef6078db2dbcd853ff05e8e03ad0b292dfc60a984af

    • Size

      369KB

    • MD5

      be1ee83eb1d54fce86f2e19a2a41b5f5

    • SHA1

      b450862528ad0d2203c81859e8a6f575a068be99

    • SHA256

      e978390c067b287c06aafef6078db2dbcd853ff05e8e03ad0b292dfc60a984af

    • SHA512

      3b4361188d5d15e495d7c0ed695c3244b0abdc4e960751b3f500dd7145e50f9b79aa5ecac6fcb0df1f246f613b61d9b8b2e461992154882a3a460def33229ddb

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks