General

  • Target

    b22ec682de4f08ffce0c1832d981f48378c9d1437bb17f93febdd9f82d5bb6e5

  • Size

    132KB

  • Sample

    220731-lb8d9aahfp

  • MD5

    9922d6342487649f86261802528a3872

  • SHA1

    5ca35435f3871c3a652eac73841ee7d884124cd7

  • SHA256

    b22ec682de4f08ffce0c1832d981f48378c9d1437bb17f93febdd9f82d5bb6e5

  • SHA512

    877429b9220caaec7a4c383cbe787a8679d809acee853b7cf15fee6bb2c11aace31338b6c234107506e21251dafdafa2021b7222fc6a4af237b56105f39dd47b

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

91.187.80.246:80

108.191.2.72:80

188.152.7.140:80

108.179.206.219:8080

59.110.18.236:443

45.56.88.91:443

206.81.10.215:8080

178.209.71.63:8080

91.231.166.126:8080

200.71.148.138:8080

87.106.139.101:8080

212.186.191.177:80

212.129.24.79:8080

173.13.135.102:80

197.254.221.174:80

37.157.194.134:443

190.211.207.11:443

190.226.44.20:21

165.228.24.197:80

107.170.24.125:8080

rsa_pubkey.plain

Targets

    • Target

      b22ec682de4f08ffce0c1832d981f48378c9d1437bb17f93febdd9f82d5bb6e5

    • Size

      132KB

    • MD5

      9922d6342487649f86261802528a3872

    • SHA1

      5ca35435f3871c3a652eac73841ee7d884124cd7

    • SHA256

      b22ec682de4f08ffce0c1832d981f48378c9d1437bb17f93febdd9f82d5bb6e5

    • SHA512

      877429b9220caaec7a4c383cbe787a8679d809acee853b7cf15fee6bb2c11aace31338b6c234107506e21251dafdafa2021b7222fc6a4af237b56105f39dd47b

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks