General

  • Target

    42da95fe4e7e62b35ca5986a655b6c807380d0851764c7653bf4e0734098df5a

  • Size

    198KB

  • Sample

    221125-kt32taab6y

  • MD5

    070392279aa9629c602f1e7c856c398a

  • SHA1

    23d624173b4d06fb6fe4aca127a93ca5c504b7ac

  • SHA256

    42da95fe4e7e62b35ca5986a655b6c807380d0851764c7653bf4e0734098df5a

  • SHA512

    581ac43093affa2d8fac27a510d1be3a76f5b592b85c7adf0386e3b3f41a18ded9c2be04812af664dbe7749a4daffa96748ab1937e3a520d48127fc9977fc749

  • SSDEEP

    1536:dMNJ7w5ncu2uOtYoH9xDLaXLyYCXQQQFQQwiXzZjBdo/3+kkBH:dg0pcu2uOn9paXuxQQQFQQxB/u3+kk9

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

192.198.91.138:443

70.39.251.94:8080

87.230.25.43:8080

94.23.62.116:8080

103.13.224.53:80

101.187.81.254:80

76.121.199.225:80

178.250.54.208:8080

45.33.77.42:8080

5.196.35.138:7080

12.163.208.58:80

37.183.81.217:80

120.72.18.91:80

81.214.253.80:443

183.176.82.231:80

185.94.252.27:443

12.162.84.2:8080

74.58.215.226:80

60.249.78.226:8080

50.28.51.143:8080

rsa_pubkey.plain

Targets

    • Target

      42da95fe4e7e62b35ca5986a655b6c807380d0851764c7653bf4e0734098df5a

    • Size

      198KB

    • MD5

      070392279aa9629c602f1e7c856c398a

    • SHA1

      23d624173b4d06fb6fe4aca127a93ca5c504b7ac

    • SHA256

      42da95fe4e7e62b35ca5986a655b6c807380d0851764c7653bf4e0734098df5a

    • SHA512

      581ac43093affa2d8fac27a510d1be3a76f5b592b85c7adf0386e3b3f41a18ded9c2be04812af664dbe7749a4daffa96748ab1937e3a520d48127fc9977fc749

    • SSDEEP

      1536:dMNJ7w5ncu2uOtYoH9xDLaXLyYCXQQQFQQwiXzZjBdo/3+kkBH:dg0pcu2uOn9paXuxQQQFQQxB/u3+kk9

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks