General

  • Target

    cd6b282ea4a3eb298035f6db29f8e6dfb24253f897120015b0c10dd0192084be

  • Size

    254KB

  • Sample

    220731-lb3h1aahep

  • MD5

    7d1d9130324cf9994da0d01ea3420289

  • SHA1

    e15c22dd2bb6926835ac94c467b9fee4af13ce4c

  • SHA256

    cd6b282ea4a3eb298035f6db29f8e6dfb24253f897120015b0c10dd0192084be

  • SHA512

    791fa9afc98bbbe52f1355a44b993a61b08593c680b9b77a49339b0cc73d0f2b73e29f66e6150cb374108820b39f9d23ac2abdbf751b2b91f0d99e9884fccc4c

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.205.247.10:80

86.22.221.170:80

85.25.255.207:8080

185.94.252.13:443

94.177.216.217:8080

62.75.187.192:8080

78.24.219.147:8080

91.205.215.66:8080

24.45.195.162:7080

94.192.225.46:80

200.113.106.18:21

186.4.172.5:8080

104.131.44.150:8080

67.225.229.55:8080

190.226.44.20:21

92.233.128.13:143

5.196.74.210:8080

185.187.198.15:80

87.230.19.21:8080

186.176.138.171:7080

rsa_pubkey.plain

Targets

    • Target

      cd6b282ea4a3eb298035f6db29f8e6dfb24253f897120015b0c10dd0192084be

    • Size

      254KB

    • MD5

      7d1d9130324cf9994da0d01ea3420289

    • SHA1

      e15c22dd2bb6926835ac94c467b9fee4af13ce4c

    • SHA256

      cd6b282ea4a3eb298035f6db29f8e6dfb24253f897120015b0c10dd0192084be

    • SHA512

      791fa9afc98bbbe52f1355a44b993a61b08593c680b9b77a49339b0cc73d0f2b73e29f66e6150cb374108820b39f9d23ac2abdbf751b2b91f0d99e9884fccc4c

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks