General

  • Target

    v636S8Ti.dll

  • Size

    462KB

  • Sample

    221118-rq31zahe78

  • MD5

    cb3f6d3a70c627c06538444b8f3cbe99

  • SHA1

    ab8313620da02538d426c1d1a0296d07d49c146e

  • SHA256

    2bb7a84ea6cf8181d1391da4e2bf48ac2517d8c1a739d16ef848f6407da2325b

  • SHA512

    826b174a01e2fa6aa33dbc6944c55f4ccba3c8a6d036d90236e9f768063a656b1ec7009358210300ecdd74c920ae94f66f48630f28f6933bb7610094c1970254

  • SSDEEP

    12288:cYI/EvSkO2GGIBaUPNGJc1jExt+9NuI6I78:RI/EoxBaQvExt+9Nu

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

138.201.142.73:8080

138.197.147.101:443

134.195.212.50:7080

104.168.154.79:8080

149.56.131.28:8080

129.232.188.93:443

212.24.98.99:8080

119.193.124.41:7080

45.118.115.99:8080

188.44.20.25:443

103.132.242.26:8080

201.94.166.162:443

1.234.21.73:7080

206.189.28.199:8080

185.8.212.130:7080

82.165.152.127:8080

176.104.106.96:8080

173.212.193.249:8080

167.99.115.35:8080

209.126.98.206:8080

eck1.plain
ecs1.plain

Targets

    • Target

      v636S8Ti.dll

    • Size

      462KB

    • MD5

      cb3f6d3a70c627c06538444b8f3cbe99

    • SHA1

      ab8313620da02538d426c1d1a0296d07d49c146e

    • SHA256

      2bb7a84ea6cf8181d1391da4e2bf48ac2517d8c1a739d16ef848f6407da2325b

    • SHA512

      826b174a01e2fa6aa33dbc6944c55f4ccba3c8a6d036d90236e9f768063a656b1ec7009358210300ecdd74c920ae94f66f48630f28f6933bb7610094c1970254

    • SSDEEP

      12288:cYI/EvSkO2GGIBaUPNGJc1jExt+9NuI6I78:RI/EoxBaQvExt+9Nu

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks